Search vulnerabilities

Expected end of text, found 'ärtsilä' (at char 8), (line:1, col:9)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,461

CVE-2026-124569

fushengqian fuintCatering CommissionCashServiceImpl.java updateCommissionCash access control

A vulnerability was found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. The affected element is the function updateCommissionCash of the file CommissionCashServiceImpl.java. The manipulation of the argument Status results in improper access controls. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fushengqian
Products
Fuintcatering
CVE-2026-124565

fushengqian fuint Order Verification MerchantOrderController.java confirm access control

A security vulnerability has been detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This affects the function confirm of the file MerchantOrderController.java of the component Order Verification. Such manipulation leads to improper access controls. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fushengqian
Products
Fuint
CVE-2026-124561

D-Link DIR-878 HNAP prog.cgi SetVLANSettings stack-based overflow

A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
D-link Dlink
Products
Dir-878 Dir-878
CVE-2026-124556

kekingcn kkFileView BaseUrlFilter.java BaseUrlFilter.getBaseUrl redirect

A security vulnerability has been detected in kekingcn kkFileView up to 5.0.3. This issue affects the function BaseUrlFilter.getBaseUrl of the file server/src/main/java/cn/keking/web/filter/BaseUrlFilter.java. The manipulation of the argument X-Base-Url leads to open redirect. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Kekingcn
Products
Kkfileview
CVE-2026-124552

Webmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgi

Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes when other users, including root, view the list page.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Webmin
Products
Webmin
CVE-2026-124508

floci-io Floci Artifact CodeBuildJsonHandler.java BuildspecParser.parseArtifacts path traversal

A vulnerability was determined in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildJsonHandler.java of the component Artifact Handler. This manipulation of the argument buildspecOverride.artifacts.base-directory causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Floci-io
Products
Floci
CVE-2026-124504

erupts erupt ReportService.java ReportService.queryBiData sql injection

A vulnerability was detected in erupts erupt up to 2.3.0. Affected by this issue is the function ReportService.queryBiData of the file ReportService.java. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 2.4.0 can resolve this issue. The patch is named 8d2eaffc79b977c9d11222b9d435a002dceaa062. It is suggested to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Erupts
Products
Erupt
CVE-2026-124499

Fengoffice Feng Office Translation Tool ToolController.class.php write_translations code injection

A vulnerability was identified in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This affects the function write_translations of the file application/controllers/ToolController.class.php of the component Translation Tool. The manipulation of the argument lang leads to code injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Fengoffice
Products
Feng Office
CVE-2026-124494

SunEditor before 3.4.0 Stored XSS via &colon; Entity Sanitizer Bypass

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like &colon; to an empty string. Attackers can inject href values such as javascript&colon; that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Jihong88
Products
Suneditor
CVE-2026-124443

Frappe before 16.35.0 Broken Access Control in File List/Report Queries

Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to obtain metadata of private files they are not permitted to access.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe
CVE-2026-124439

Scriban before 7.5.3 Denial of Service via Uncatchable StackOverflowException

Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an uncatchable StackOverflowException that terminates the host process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Scriban
Products
Scriban
CVE-2026-124422

SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jihong88
Products
Suneditor
CVE-2026-124329

FlowCI flow-core-x FileHelper.java FileHelper.unzip path traversal

A vulnerability was found in FlowCI flow-core-x up to 1.23.49. The impacted element is the function FileHelper.unzip of the file common/src/main/java/com/flowci/common/helper/FileHelper.java. The manipulation results in path traversal. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Flowci
Products
Flow-core-x
CVE-2026-123660

Vulnerability-Lookup: memory amplification through webhook payload template format specifiers

In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification's payload template. Each placeholder's format specifier was passed unchanged to Python's string formatting, which builds the padded result before its size can be checked. A template of a few dozen bytes, such as {"text": "{title:>999999999}"}, therefore produced a string of about 1 GB when the notification form test-rendered it on save, and repeating such fields multiplied the cost. Templates that passed the save check could also repeat placeholders such as {text} thousands of times; the notification daemon rebuilt those on every webhook delivery. Deeply nested templates raised an unhandled recursion error (HTTP 500). An attacker needs only an account, which the default configuration lets anyone create after e-mail confirmation. They could exhaust the memory of web workers or the notification daemon, causing a denial of service. Version 6.4.1 caps every number in a format specifier at 256, limits a rendered template to 1,000,000 characters both on save and at delivery, and rejects templates nested deeper than 32 levels.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Circl
Products
Vulnerability-lookup
CVE-2026-123613

Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass

Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Rustls Project
Products
Rustls
CVE-2026-123609

Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug

Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.

CVSS 4.0 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Rustls Project
Products
Rustls
CVE-2026-123569

Devalue before 5.6.3 Denial of Service via Sparse Array Serialization

The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause a denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Svelte
Products
Devalue
CVE-2026-123565

Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval

Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhausts memory or CPU.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Svelte
Products
Devalue
CVE-2026-123561

Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion

devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a __proto__ own property, which alone does not cause prototype pollution.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Svelte
Products
Devalue
CVE-2026-123557

Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection

ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated remote peers to abort the node by triggering disconnection during a blocked outbound send. Malicious peers can return empty FindBlocks or FindHeaders replies and stop reading their socket, dropping an unresolved MustUseClientResponseSender and terminating syncing nodes.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra