Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 34,351

CVE-2026-129258

Tenda AC18 Firmware Upgrade upgrade data authenticity

A vulnerability was identified in Tenda AC18 15.03.05.05_multi/15.03.05.19 Build 6318. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/upgrade of the component Firmware Upgrade Handler. Such manipulation of the argument upgradeFile leads to insufficient verification of data authenticity. The attack may be launched remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed
Vendors
Tenda
Products
Ac18 Ac18 Firmware
CVE-2026-59514

WordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyBoss Buddyboss Platform buddyboss-platform allows Blind SQL Injection.This issue affects Buddyboss Platform: from n/a through 3.0.5.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Mightynetworks Vs Buddyboss Wordpress
Products
Buddyboss Platform Wordpress
CVE-2026-39732

WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in INTINITUM FORM Transliterator serbian-transliteration allows Blind SQL Injection.This issue affects Transliterator: from n/a through 2.5.13.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62031

WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes uListing ulisting allows Blind SQL Injection.This issue affects uListing: from n/a through 2.2.0.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-19907

Shipo 1.6 - 1.8.0 - Authentication Bypass to Administrator

The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie's cryptographic signature. The function's intended `/wp-json/shipo/` route restriction can also be bypassed by placing that substring in the query string of an unrelated REST endpoint. This makes it possible for unauthenticated attackers who know an existing username to impersonate that user, including an administrator, and perform authorized actions through the REST API, including creating another administrator account.

CVSS 3.1 · 9.8 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-120522

Cloud Storage Manager for Fluent Forms <= 1.2.0 - Unauthenticated Arbitrary File Write via Google Drive Filename Path Traversal

The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 1.2.0. This is due to missing authorization checks on the `connection/{driver}/save` and `/download/single-file` REST endpoints, combined with insufficient path validation in the Google Drive `downloadFile()` function, where the Google Drive metadata `name` value is concatenated into a local path without `basename()`, `sanitize_file_name()`, or canonical path validation. This makes it possible for unauthenticated attackers to store attacker-controlled Google Drive credentials, trigger a download of an attacker-owned file whose provider-returned filename contains path traversal, and write attacker-controlled content outside the intended `downloads` directory. When the written file has a PHP extension and lands in a web-accessible location, this can lead to remote code execution.

CVSS 3.1 · 9.8 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-129433

Dokploy before 0.31.1 OS Command Injection via Compose Backup serviceName

Dokploy before 0.31.1 contains an OS command injection vulnerability in getComposeContainerCommand() that allows authenticated organization members to execute shell commands via the serviceName parameter. Attackers can store serviceName values with shell metacharacters through backup.create or backup.update tRPC procedures, executing commands as root when scheduled backups run and taking over the host via the mounted Docker socket.

CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2026-129250

Edimax BR6478ACV2 webs formPPTPSetup buffer overflow

A security vulnerability has been detected in Edimax BR6478ACV2 1.23. The impacted element is the function formPPTPSetup of the file webs. The manipulation of the argument pptpUserName leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed
Vendors
Edimax
Products
Br6478acv2
CVE-2026-119990

Azure OpenAI Elevation of Privilege Vulnerability

Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Open-ai Azure Open-ai
CVE-2026-55335

Use-After-Free in Android Code Allows Remote Code Execution

In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-55362

Out‑of‑Bounds Write in Android Enables Remote Code Execution

In multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-56971

Android AudioSession Double‑Free Vulnerability Enables Remote Code Execution

In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-57010

Out‑of‑Bounds Write in Android Data Manager Enables Remote Privilege Escalation

In EncodeLastScanBufferElement of data_manager.cc, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-57047

Media Codec Out-of-Bounds Write Enabling Remote Code Execution on Android

In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-58705

Android gscan Heap Overflow Enables Remote Privilege Escalation

In handleEvent of gscan.cpp, there is a possible way to trigger an out of bounds write on the heap due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-58736

Android SIP Use‑After‑Free Vulnerability Leading to Remote Privilege Escalation

In NotifySipResponse of SessionEx.cpp, there is a possible way to corrupt memory via a dangling connection pointer in the pending response queue due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android