Search vulnerabilities

Expected end of text, found '–' (at char 31), (line:1, col:32)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,461

CVE-2026-60041

CSRF in backend

An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Firmware Myrex24v2virtual Mbconnect24 and 1 more
CVE-2026-59986

rabbitmq-c: amqp_decode_bytes size_t integer overflow bypasses bounds check on 32-bit (OOB read)

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) <= encoded.len overflows when o + len > SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field length. The overflow wraps the check to a small value that passes, producing a decoded amqp_bytes_t with a multi-GB .len pointing into a small frame buffer. This results in an out-of-bounds read of up to ~4GB of process memory on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients). Enabling information disclosure or denial of service. Not exploitable on 64-bit systems where size_t is 64-bit. This issue has been patched in version 0.17.0.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-57907

WatchGuard Endpoint Protection Local Privilege Escalation in Console-Service Communication Allows SYSTEM Code Execution

A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process and issuing privileged commands to the service.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Endpoint Security
CVE-2026-21441

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.

CVSS 4.0 · 8.9 High EPSS 2.9% KEV · Not listed
Vendors
Python Urllib3
Products
Urllib3 Urllib3
CVE-2026-17437

IBM App Connect Enterprise is vulnerable to an arbitrary file write

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
App Connect Enterprise
CVE-2026-17355

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to server-side request forgery. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems that should be blocked.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17352

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17334

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization via user-controlled keys.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17330

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17325

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17304

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Locations supplied when service definitions are imported are not sufficiently validated, which could allow the server to retrieve content it should not access.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17188

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. When service definitions are imported, references to external resources are not sufficiently restricted, so the server could be made to request resources it should not access.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17187

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17154

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform cross-site scripting due to improper neutralization of user-supplied input.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-125757

mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer

mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Mailcow
Products
Mailcow\
CVE-2026-125753

ABP Framework before 10.6.2 and 10.7.0 Path Traversal via Blogging File Endpoints

ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging api/blogging/files/{name} endpoint on Windows hosts to read files like appsettings.json containing signing keys and connection strings.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125749

TaxHacker through 0.8.5 IDOR via Settings Server Actions userId

TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/(app)/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCategoryAction or editFieldAction with a victim's UUID to delete categories, clear transaction assignments, or alter LLM prompts.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125745

WCK before 2.4.1 Missing Authorization via wck_show_update_form AJAX

Custom Post Types and Custom Fields creator (WCK) before 2.4.1 contains a missing authorization vulnerability that allows authenticated attackers with access to any WCK meta box to read custom-field values on posts they cannot edit by exploiting the wck_show_update_form AJAX handler, which lacks the capability checks enforced by other handlers and relies on a shared, non-unique nonce action. Attackers can send a crafted admin-ajax.php request with a valid wck-edit-entry nonce, a target meta key, and an arbitrary post ID to disclose sensitive post-meta or option values belonging to other users, including private or draft post data.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—