Search vulnerabilities

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,822

CVE-2026-63424

Improperly Protected Key Enables Local Privilege Escalation in Lenovo Dock Manager

During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Dock Manager
CVE-2026-25652

ColdFusion | Incorrect Authorization (CWE-863)

is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Coldfusion Coldfusion 2023 Coldfusion 2025
CVE-2026-34635

ColdFusion | Use of Hard-coded Cryptographic Key (CWE-321)

is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Coldfusion Coldfusion 2023 Coldfusion 2025
CVE-2026-19734

IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking

Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company's product and to hijack that product by reassigning its company_id, via the product's numeric identifier, because `ProductUpdateController` did not extend `MainController` and therefore required no authentication check on the read endpoint, and `ProductRepository::save()` retrieved the record via `Product::find($data['id'])` without constraining the query to the authenticated user's company before overwriting its company_id.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Roskus
Products
Prospero Flow Crm
CVE-2026-12036

Local Authenticated User Can Delete Arbitrary Files Using Improper Link Following in Lenovo Vantage Addin

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Vantage
CVE-2026-63425

Improper Permissions in Lenovo Dock Manager Allowing Local Privilege Escalation

During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticated user to execute arbitrary code with elevated privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Dock Manager
CVE-2026-63423

Local Privilege Escalation in Lenovo Accessories and Display Manager

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Accessories And Display Manager
CVE-2026-15994

Local Authenticated Improper Link Following Enables Privilege Escalation in Lenovo Vantage

During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Commercial Vantage Vantage
CVE-2026-66693

WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability

Subscriber Broken Access Control in Motors <= 1.4.113 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Motors Wordpress
CVE-2026-73349

WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nexcess Wordpress
Products
Givewp Wordpress
CVE-2026-16860

IBM i is Affected By Remote Code Execution Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-16863

IBM i is Affected By Out-of-Bounds Read Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-16904

IBM i is Affected By improper privilege management in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-16931

IBM i is Affected By A Denial of Service Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-16956

IBM Db2 Mirror for i is vulnerable to OS command injection []

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Db2 Mirror For I