Search vulnerabilities

Expected end of text, found '/' (at char 33), (line:1, col:34)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,866

CVE-2026-14973

Path Traversal in IBM Desktop App

IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Apple Ibm Linux and 1 more
Products
Macos Aspera Aspera Desktop App and 2 more
CVE-2026-68443

hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop

In the Linux kernel, the following vulnerability has been resolved: hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability. Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-73218

Cursor: Sandbox escape via launching privileged containers

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access to the user's home directory and enabling host command execution with the user's privileges without an additional permission prompt. This issue is fixed in version 3.0.0.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Cursor
Products
Cursor
CVE-2026-73230

Ente: 2of3 cards v1 contain a checksum that enables offline guessing of low-entropy secrets

Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card, allowing someone with one card to test candidate secrets offline and recover low-entropy or predictable secrets. This issue is fixed in version 2026.07.28.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ente
Products
Ente
CVE-2025-71394

SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-73227

electerm's RDP clipboard file download may parse unsafe file name

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write attacker-controlled content outside the selected save directory because the RDP clipboard download path in src/client/components/rdp/file-transfer.js passes the server-controlled CLIPRDR filename fileInfo.name to osResolve without sanitization. This issue is fixed in version 3.15.120.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Electerm
Products
Electerm
CVE-2025-71396

SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-53309

ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of qr_regions. The other loops in the same function correctly use '<'. Fix the loop condition to use '<' for consistency and correctness.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2025-71397

SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) to define custom database functions via DEFINE FUNCTION using nested FOR loops. Although a single loop's iteration count is constrained, nesting multiple loops (e.g., each with 1,000,000 iterations) is not, so an attacker can execute a function that consumes all server CPU time. Configured timeouts do not stop the execution, rendering the server unresponsive to other queries and connections until it is manually restarted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-12539

Docker Sandboxes ICMP egress restriction bypass after daemon restart

Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arbitrary hosts. A workload inside a sandbox, which the threat model treats as untrusted, can therefore defeat the documented ICMP egress block to perform network reconnaissance and exfiltrate data over an ICMP covert channel, regardless of the configured allowlist.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Docker
Products
Docker Sandboxes
CVE-2026-12039

Docker Sandboxes network egress allowlist bypass via unfiltered DNS resolution

Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network embedded DNS server forwards any queried name to the host resolver whenever the network is internet-connected, without consulting the policy. A workload inside a sandbox, which the threat model treats as untrusted, can therefore encode data into DNS labels for an attacker-controlled domain and exfiltrate it through a DNS covert channel, bypassing the configured allowlist.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Docker
Products
Docker Sandboxes
CVE-2026-8985

Unauthenticated Command Injection

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.

CVSS 4.0 · 10 Critical EPSS 7.1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Single Charger Maxicharger Single Charger Firmware
CVE-2026-8986

Command Injection via Malicious OCPP Server

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station.

CVSS 4.0 · 9.5 Critical EPSS 3.3% KEV · Not listed
Vendors
Autel
Products
Maxicharger Single Charger Maxicharger Single Charger Firmware