Search vulnerabilities

Expected end of text, found ':' (at char 22), (line:1, col:23)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,863

CVE-2026-46405

OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the `GET` handler, or when an `Authorization: Negotiate` header is supplied, the response is includes a `logical.Auth` object in addition to an error message. This results in tokens being created with only the default policy, default TTL, and no entity information, which are hidden by the returned error message. No access to these tokens by the caller occurs and the authentication token is not ever made accessible outside of `sys/raw`. This is fixed in OpenBao v2.5.4. As a workaround, users may set a rate limit quota to limit the creation of these paths. As the path is unauthenticated, it isn't possible to deny access to it.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openbao
Products
Openbao
CVE-2026-45819

baseline-browser-mapping: baseline-browser-mapping: Denial of Service via improper input handling

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Web-platform-dx
Products
Baseline-browser-mapping
CVE-2026-19311

Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Aws Github
Products
Opensearch Opensearch
CVE-2026-19091

GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed
Vendors
Paoltaia Wordpress
Products
Geodirectory – Wp Business Directory Plugin And Classified Listings Directory Wordpress
CVE-2026-19088

ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Roxnor Wordpress
Products
Shopengine Elementor Woocommerce Builder Addon Wordpress
CVE-2026-18679

Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Konghq
Products
Kong Mesh
CVE-2026-18678

Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.

CVSS 4.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Konghq
Products
Kong Mesh
CVE-2026-18677

Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload's SPIFFE identity.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Konghq
Products
Kong Mesh
CVE-2026-18676

Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Konghq
Products
Kong Mesh
CVE-2026-18673

Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network access to a data plane's port 9902, for example another pod on the cluster network, can read Envoy and data plane configuration without credentials: config dumps, cluster and listener lists, stats, and the mesh trust bundle. Exposure is read-only - destructive Envoy admin actions are blocked and private keys are not exposed.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Konghq
Products
Kong Mesh
CVE-2026-18368

Heap buffer overflow in Modbusgwd

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Teltonika-networks
Products
Rutos
CVE-2026-16459

Timing side-channel in RSA PKCS#1 v1.5 decryption in Oberon PSA Crypto

Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Oberon Microsystems Ag
Products
Oberon Psa Crypto
CVE-2026-16458

Timing side-channel in RSA PKCS#1 v1.5 decryption in ocrypto

Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Oberon Microsystems Ag
Products
Ocrypto
CVE-2026-14213

Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Ameliabooking Wordpress
Products
Booking For Appointments And Events Calendar Wordpress
CVE-2026-14182

Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpfactory
Products
Wordpress Customer Email Verification For Woocommerce
CVE-2026-11970

Forcepoint One Endpoint SafariExtension Disable Bypass

This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E Mac OS before v26.04.5758.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Forcepoint
Products
F1e Mac
CVE-2025-31114

Fooocus webui vulnerable to Remote Code Execution

Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of time of publication, no known patched versions are available, but a suggested fix pull request is available.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Lllyasviel
Products
Fooocus
CVE-2024-8060

Remote Code Execution in OpenWebUI via Arbitrary File Upload

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS n/a EPSS n/a KEV · Not listed
Vendors
Open-webui
Products
Open-webui