Search vulnerabilities

Expected end of text, found '\' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-72549

OpenSignLabs OpenSign - Information Disclosure

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning the internal identifier. An attacker can use this to enumerate user accounts and target subsequent attacks.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Opensignlabs
Products
Opensignserver
CVE-2026-72554

Ladybird Web Solution Faveo Helpdesk - Broken Access Control

A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticated user to access arbitrary ticket threads including internal agent notes containing sensitive information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ladybirdweb
Products
Faveo Helpdesk
CVE-2026-72555

Peppermint Lab Peppermint - Broken Access Control

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass ownership and administrative access controls. An attacker with any user account can read, modify, or delete tickets, clients, and users belonging to any other account.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Peppermint
Products
Peppermint
CVE-2026-72561

Peppermint Lab Peppermint - Broken Access Control

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before applying new OIDC issuer settings. An attacker can redirect all SSO logins to an attacker-controlled identity provider, enabling credential harvesting for all platform users.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Peppermint
Products
Peppermint
CVE-2026-72562

Pimcore pimcore admin-ui-classic-bundle - SQL Injection

An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker with backend access can exfiltrate or modify all database contents.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Admin Classic Bundle
CVE-2026-72601

CSZ CMS CSZ CMS - Broken Access Control

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper fails open. An unauthenticated attacker can access all contact form submissions without credentials.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cszcms
Products
Csz Cms
CVE-2026-72605

Swing Music Swing Music - Missing Authentication

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can register an account and use it to access protected functionality on the server.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Swingmx
Products
Swing Music
CVE-2026-59693

Denial of Service via Malformed BACnet Packet in Siemens Desigo Device

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.21.233.16-7862), Desigo PXC4 (All versions < V02.21.194.36-2715), Desigo PXC5.E003 (All versions < V02.21.194.36-2715), Desigo PXC5.E24 (All versions < V02.21.194.36-2715), Desigo PXC7 (All versions < V02.21.194.36-2715). The affected devices are vulnerable to a denial-of-service (DoS) vulnerability. An attacker can exploit this issue by sending a malformed BACnet packet, causing the device to stop responding to BACnet queries. Recovery requires a device reset or reboot to restore normal functionality.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Siemens
Products
Desigo Dxr2 Desigo Pxc3 Desigo Pxc4 and 2 more
CVE-2026-72925

SWC HTML minifier may allow script element breakout when minifying embedded JSON

SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script elements without the escape_json_for_html_script behavior to re-escape less-than signs, allowing a closing script sequence to terminate the element early and execute script in the generated page's origin. This issue is fixed in @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Swc Project
Products
Html Swc Swc Html Minifier
CVE-2026-73066

Tesseract: Heap out-of-bounds write in LSTM Convolve layer via crafted .traineddata

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-bounds write during OCR recognition. This issue is fixed in version 5.5.3.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tesseract Project
Products
Tesseract
CVE-2026-73067

Tesseract: Heap OOB read in the DAWG loader

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Tesseract Project
Products
Tesseract
CVE-2026-73069

Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution

Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permission to supply settings.asExpression for the system TS_VECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation, causing buildSqlColumnDefinition in packages/twenty-server/src/engine/twenty-orm/workspace-schema-manager/utils/build-sql-column-definition.util.ts to concatenate unescaped input into GENERATED ALWAYS AS (...) and execute arbitrary PostgreSQL statements as the application database user. This issue is fixed in version 2.15.0.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Twenty
Products
Twenty
CVE-2026-19078

Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter.

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an attacker-controlled website. This could enable phishing attacks, potentially tricking users into revealing sensitive information.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Container Platform
CVE-2026-53416

Zoom VDI - Path Traversal

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Zoom Communications
Products
Zoom Vdi
CVE-2026-18247

DOM-Based Cross-Site Scripting in BlackBerry AtHoc Web Portals

A Cross Site Scripting (XSS) vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Blackberry
Products
Blackberry Os
CVE-2026-28700

EquiTriton Uncontrolled Search Path Enables Local Privilege Escalation

Uncontrolled search path for some EquiTriton before version f5ddbb5 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Intel
Products
Equitriton
CVE-2026-28707

Privilege Escalation in LLM‑on‑Ray via Ring 3 Protection Failure

Protection mechanism failure for some LLM-on-Ray before version 1.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Intel
Products
Llm-on-ray
CVE-2025-31356

TDX Data Authenticity Verification Flaw Enabling Information Disclosure

Insufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: Hypervisor may allow an information disclosure. A system software adversary with a privileged user access combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without any user interaction. The potential vulnerability may impact the confidentiality (high), integrity (low) and no effect on availability. Subsequent system impacts include reduced confidentiality (low), integrity (low), and no effect on availability.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Intel
Products
Trust Domain Extensions
CVE-2025-31938

Intel Xeon TDX Subsystem Access Control Weakness Leading to Potential Information Disclosure

Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6 Scalable processors with Intel(R) TDX may allow an information disclosure. Authorized adversary with an authenticated user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Intel
Products
Xeon
CVE-2026-73086

nanoid: Integer Overflow or Wraparound

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Nanoid Project Redhat
Products
Nanoid Hummingbird