Search vulnerabilities

Expected end of text, found ':' (at char 25), (line:1, col:26)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,857

CVE-2026-11596

Authenticated Host Pass Creation Allows Arbitrary Token Expiration in ScreenConnect

In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creation privileges the ability to specify a token expiration duration beyond the intended maximum when generating delegated access tokens.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Connectwise
Products
Screenconnect
CVE-2026-73348

WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Nexcess Wordpress
Products
Givewp Wordpress
CVE-2026-73356

WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability

Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Cloudways Wordpress
Products
Breeze Wordpress
CVE-2026-73393

WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
Subscribe2 Wordpress
CVE-2026-49987

Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection that bypasses validateGitUrl() dangerous parameter checks and can execute commands through local or SSH-style transports. This issue is fixed in version 1.14.1.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Yamadashy
Products
Repomix
CVE-2026-49988

Repomix: attach_packed_output can bypass file-read secret scanning for supported local files

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can register and read arbitrary local .json, .txt, .md, or .xml files without the file_system_read_file runSecretLint() safety check or Repomix packed-output validation, allowing MCP callers to bypass the local file-read secret-scanning boundary. This issue is fixed in version 1.14.1.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Yamadashy
Products
Repomix
CVE-2026-2366

Keycloak: keycloak: information disclosure via authorization bypass in admin api

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Keycloak Redhat
Products
Keycloak Build Keycloak Build Of Keycloak
CVE-2026-3429

Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered MFA/OTP credential without first proving possession of that factor. The attacker can then register their own MFA device, effectively taking full control of the account. This weakness undermines the intended protection provided by multi-factor authentication.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Keycloak Redhat
Products
Keycloak Build Keycloak Build Of Keycloak and 3 more
CVE-2026-15337

Potential denial-of-service vulnerability in check_for_language()

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Jaeyoung Jang for reporting this issue.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Djangoproject
Products
Django
CVE-2026-66637

WordPress Featured Video Plus plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Alex Wordpress
Products
Featured Video Plus Wordpress
CVE-2026-15307

Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed
Vendors
Djangoproject
Products
Django
CVE-2026-10080

Boards plugin panics on WebSocket command with non-string field types

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.. Mattermost Advisory ID: MMSA-2026-00687

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-75904

libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File

libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Konstanty Bialkowski
Products
Libmodplug
CVE-2026-75531

Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora

Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to HTML escaping by the template engine, it was embedded inside a JavaScript string within an HTML attribute. An attacker-controlled URL containing specially crafted characters could therefore break out of the JavaScript string and inject arbitrary JavaScript code. The malicious script would execute in the context of the Pandora web application when a victim interacts with the affected Submit to Lookyloo control. Successful exploitation could allow an attacker to access information available to the victim's browser or perform actions using the victim's authenticated Pandora session. The patch removes the observable value from the inline JavaScript handler. The URL is instead stored in an HTML data-url attribute and retrieved through the DOM dataset API when needed. Additional uses of innerHTML were also replaced with textContent as defensive hardening.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Pandora-analysis
Products
Pandora
CVE-2026-75529

Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/<task_id>/.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using send_file(task.file.path) without explicitly specifying the MIME type or forcing it to be downloaded as an attachment. Because Flask determines the response MIME type from the filename when a path is supplied, an attacker could submit a file whose content is recognized by Pandora as a PDF while its filename or extension causes the download endpoint to return it with a different, potentially active MIME type. A specially crafted PDF/polyglot file could therefore be served inline and interpreted by a victim's browser as HTML or another executable web format. If a victim with access to the submitted analysis follows the PDF download link, attacker-controlled script could execute in the security context of the Pandora application, potentially allowing access to application data or actions using the victim's session. The patch prevents the issue by explicitly returning PDF downloads with Content-Type: application/pdf, forcing Content-Disposition: attachment, and assigning a trusted .pdf filename based on the task UUID.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Pandora-analysis
Products
Pandora