Search vulnerabilities

Expected end of text, found '‑' (at char 7), (line:1, col:8)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,948

CVE-2026-27365

WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Publishpress Wordpress
Products
Publishpress Series Wordpress
CVE-2026-74804

Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-75114

Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64

Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedirect() with no validation.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-74803

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-71960

Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate credentials, gaining unauthorized access to the device's mesh networking interface.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Shenzhen Cudy Technology
Products
Wr3000 2.0
CVE-2026-71961

Cudy WR3000 2.0 OS Command Injection via Mesh MQTT Command Handler

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.

CVSS 4.0 · 8.7 High EPSS 2.7% KEV · Not listed
Vendors
Shenzhen Cudy Technology
Products
Wr3000 2.0
CVE-2026-76610

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-77029

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-77028

Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66

Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-75115

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Yootheme Pro Extension For Joomla
CVE-2026-76611

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-76612

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-75928

Brushfire unauthenticated information disclosure

The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Brushfire
Products
Online Experience
CVE-2026-75932

Jet Admin tenant isolation failure

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth Client ID and Client Secret if the victim is using an OAuth provider.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Jet Admin
Products
Jet Admin
CVE-2026-75933

Jet Admin Stored XSS

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Jet Admin
Products
Jet Admin
CVE-2026-17250

Authenticated Remote Code Execution via Stack-Based Buffer Overflow in Firmware Update Handling

A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a firmware image. Successful exploitation may allow an authenticated attacker to trigger memory corruption and execute arbitrary code on the affected device.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tl-mr6400 V7
CVE-2026-62675

Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validate_agent_bundle does not reject a tools..callable dotted Python path. omnigent/runner/tool_dispatch.py _resolve_spec_callable imports the specified module and _execute_spec_callable_tool invokes the resolved function, allowing a bundle to select subprocess.check_output and execute a local command with the runner process permissions. This can expose runner files, environment variables, credentials, workspace data, internal services, and availability without administrator access. This issue is fixed in version 0.3.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Omnigent-ai
Products
Omnigent
CVE-2026-71494

Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Infracost
Products
Infracost
CVE-2026-63004

Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry in src/lib/addons/addon.ts without restricting loopback, link-local, private, or cloud metadata addresses. An authenticated actor with the root CREATE_ADDON or UPDATE_ADDON permission can cause the server to send requests from inside its network boundary, use integration event status as a blind probing oracle, forward Authorization, customHeaders, or DD-API-KEY values to an attacker-observed host, and deliver the feature-event JSON body to internal services. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Unleash
Products
Unleash