Search vulnerabilities

Expected end of text, found '/' (at char 33), (line:1, col:34)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,866

CVE-2026-48804

python-socketio: Binary attachment accumulation can cause denial of service

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to version 5.16.4, an attacker can submit a binary message and intentionally omit sending one or more of its attachments to cause the message along with the partial list of received attachments to stay in memory for a long time. Version 5.16.4 takes the following measures to address this issue: Binary packets are only accepted from authenticated clients and, when a client disconnects, the server checks if there is a partial binary message being held for the client and deletes it.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Miguelgrinberg
Products
Python-socketio
CVE-2026-48802

python-engineio has unbound thread allocation that can cause denial of service

python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection is received, and when the client sends a PONG packet. This issue primarily affects synchronous servers. Asynchronous servers allocate background tasks instead of physical threads, which are lightweight and less likely to cause denial of service. However, the fix that was implemented was also applied to the asynchronous case. Version 4.13.2 addresses this issue as follows: The initial background thread (or async task( for heartbeat management is only launched if a client passes authentication in the `connect` handler; and the server now ensures that there is only one background heatbeat thread (or async task) per client at a given point in time. Out of sequence PONG packets are now discarded when an active heartbeat thread is already running.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Miguelgrinberg
Products
Python-engineio
CVE-2026-48495

TypeBot Google Sheets OAuth callback can create credentials in unauthorized workspaces and modify arbitrary typebots

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded `workspaceId`, `typebotId`, `blockId`, and `redirectUrl` without cryptographic integrity protection or authorization checks. The callback route is authenticated, but it does not verify that the authenticated user has write access to the target workspace or Typebot before creating credentials in the workspace or updating Typebot groups. An authenticated user who can obtain a valid Google OAuth `code` can alter the `state` value to create Google Sheets credentials in another workspace and, if target IDs are known, attach those credentials to a block in another Typebot. Version 3.17.0 patches the issue.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Baptistearno
Products
Typebot.io
CVE-2026-46670

YesWiki: Unauthenticated SQL Injection

YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an `INSERT` statement and read the full database, including `yeswiki_users.password` hashes. Version 4.6.4 fixes the issue.

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Yeswiki
Products
Yeswiki
CVE-2026-46405

OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the `GET` handler, or when an `Authorization: Negotiate` header is supplied, the response is includes a `logical.Auth` object in addition to an error message. This results in tokens being created with only the default policy, default TTL, and no entity information, which are hidden by the returned error message. No access to these tokens by the caller occurs and the authentication token is not ever made accessible outside of `sys/raw`. This is fixed in OpenBao v2.5.4. As a workaround, users may set a rate limit quota to limit the creation of these paths. As the path is unauthenticated, it isn't possible to deny access to it.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openbao
Products
Openbao
CVE-2026-45819

baseline-browser-mapping: baseline-browser-mapping: Denial of Service via improper input handling

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Web-platform-dx
Products
Baseline-browser-mapping
CVE-2026-19311

Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Aws Github
Products
Opensearch Opensearch
CVE-2026-19091

GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed
Vendors
Paoltaia Wordpress
Products
Geodirectory – Wp Business Directory Plugin And Classified Listings Directory Wordpress
CVE-2026-19088

ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Roxnor Wordpress
Products
Shopengine Elementor Woocommerce Builder Addon Wordpress
CVE-2026-18679

Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Konghq
Products
Kong Mesh
CVE-2026-18678

Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.

CVSS 4.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Konghq
Products
Kong Mesh
CVE-2026-18677

Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload's SPIFFE identity.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Konghq
Products
Kong Mesh
CVE-2026-18676

Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Konghq
Products
Kong Mesh
CVE-2026-18673

Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network access to a data plane's port 9902, for example another pod on the cluster network, can read Envoy and data plane configuration without credentials: config dumps, cluster and listener lists, stats, and the mesh trust bundle. Exposure is read-only - destructive Envoy admin actions are blocked and private keys are not exposed.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Konghq
Products
Kong Mesh
CVE-2026-18368

Heap buffer overflow in Modbusgwd

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Teltonika-networks
Products
Rutos
CVE-2026-16459

Timing side-channel in RSA PKCS#1 v1.5 decryption in Oberon PSA Crypto

Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Oberon Microsystems Ag
Products
Oberon Psa Crypto
CVE-2026-16458

Timing side-channel in RSA PKCS#1 v1.5 decryption in ocrypto

Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Oberon Microsystems Ag
Products
Ocrypto
CVE-2026-14213

Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Ameliabooking Wordpress
Products
Booking For Appointments And Events Calendar Wordpress
CVE-2026-14182

Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpfactory
Products
Wordpress Customer Email Verification For Woocommerce