Search vulnerabilities

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,822

CVE-2026-69189

Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries. This issue is fixed in version 2026.6.0.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Hoppscotch
Products
Hoppscotch
CVE-2026-45733

Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Triliumnext
Products
Trilium
CVE-2026-64881

Command Injection

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.

CVSS 4.0 · 8.7 High EPSS 2.2% KEV · Not listed
Vendors
Linux Tenable
Products
Linux Kernel Security Center
CVE-2026-54672

electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`

electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Electron Electron-userland
Products
Electron-builder App-builder-lib Electron-builder
CVE-2026-11596

Authenticated Host Pass Creation Allows Arbitrary Token Expiration in ScreenConnect

In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creation privileges the ability to specify a token expiration duration beyond the intended maximum when generating delegated access tokens.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Connectwise
Products
Screenconnect
CVE-2026-73348

WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Nexcess Wordpress
Products
Givewp Wordpress
CVE-2026-73356

WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability

Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Cloudways Wordpress
Products
Breeze Wordpress
CVE-2026-73393

WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
Subscribe2 Wordpress
CVE-2026-49987

Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection that bypasses validateGitUrl() dangerous parameter checks and can execute commands through local or SSH-style transports. This issue is fixed in version 1.14.1.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Yamadashy
Products
Repomix
CVE-2026-49988

Repomix: attach_packed_output can bypass file-read secret scanning for supported local files

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can register and read arbitrary local .json, .txt, .md, or .xml files without the file_system_read_file runSecretLint() safety check or Repomix packed-output validation, allowing MCP callers to bypass the local file-read secret-scanning boundary. This issue is fixed in version 1.14.1.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Yamadashy
Products
Repomix
CVE-2026-2366

Keycloak: keycloak: information disclosure via authorization bypass in admin api

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Keycloak Redhat
Products
Keycloak Build Keycloak Build Of Keycloak
CVE-2026-3429

Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered MFA/OTP credential without first proving possession of that factor. The attacker can then register their own MFA device, effectively taking full control of the account. This weakness undermines the intended protection provided by multi-factor authentication.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Keycloak Redhat
Products
Keycloak Build Keycloak Build Of Keycloak and 3 more
CVE-2026-15337

Potential denial-of-service vulnerability in check_for_language()

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Jaeyoung Jang for reporting this issue.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Djangoproject
Products
Django
CVE-2026-66637

WordPress Featured Video Plus plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Alex Wordpress
Products
Featured Video Plus Wordpress
CVE-2026-15307

Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed
Vendors
Djangoproject
Products
Django