Search vulnerabilities

Expected end of text, found '\' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,829

CVE-2026-71988

MSI Radix AXE6600 v781521 Command Injection via portFw function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

CVSS 4.0 · 9.3 Critical EPSS 2.5% KEV · Not listed
Vendors
Msi
Products
Radix Axe6600
CVE-2026-71989

MSI Radix AXE6600 v781521 Command Injection via porTrigger function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

CVSS 4.0 · 9.3 Critical EPSS 2.5% KEV · Not listed
Vendors
Msi
Products
Radix Axe6600
CVE-2026-72904

Firecrawl: Arbitrary file read via JSON Schema $ref expansion

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction functionality due to unsafe schema dereferencing of user-supplied JSON schemas in apps/api/src/lib/extract/helpers/dereference-schema.ts. The affected code invokes the json-schema-ref-parser dependency with default resolver settings, allowing external and local file references to be resolved during schema processing. An authenticated attacker can supply a malicious schema containing a $ref within default, const, or enum fields that are not traversed by AJV validation. By triggering a dereference error, file contents from the extract worker filesystem may be included in persisted error messages returned through the extraction API, enabling arbitrary file reads and SSRF against internal or external HTTP endpoints. This issue is fixed in version 2.11.32.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Firecrawl
Products
Firecrawl
CVE-2026-66773

Server-controlled `__next` URL is not checking cross-origin

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Odata
CVE-2026-71993

MSI Radix AXE6600 v781521 Command Injection via openvpn function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.

CVSS 4.0 · 9.3 Critical EPSS 2.5% KEV · Not listed
Vendors
Msi
Products
Radix Axe6600
CVE-2026-66779

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP

Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed and reflected within the DOM on the client side during page rendering, resulting in the execution of malicious content in the victim's browser context. Successful exploitation could result in a high impact to the confidentiality and a low impact to the integrity of the system, while availability remains unaffected.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sap Netweaver Application Server For Abap
CVE-2026-58231

Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sap Commerce Cloud Data Hub Adapter Sap Commerce Cloud Data Hub Adapter
CVE-2026-72919

Rocket.Chat: Broken Access Control in channels.convertToTeam Allows Unauthorized Conversion of Public Channels into Teams

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the channels.convertToTeam REST endpoint allows an authenticated registered user with the create-team permission to convert an unrelated public channel by supplying channelName instead of channelId because the edit-room permission is checked only for channelId. This issue is fixed in versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Rocketchat
Products
Rocket.chat
CVE-2026-13133

DLL Hijacking via Unsecure Msftedit.dll Loading in LINE for Windows

A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Ly Corporation
Products
Line For Windows
CVE-2026-12570

Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keras

A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py does not validate the shape or size of datasets, leading to unbounded memory allocation. A specially crafted .keras file can exploit this flaw to trigger an out-of-memory (OOM) condition, causing the process to be terminated (exit code 137). This issue bypasses the fix for CVE-2026-0897, which only addressed a similar vulnerability in KerasFileEditor. The attack vector includes poisoned models from public repositories or malicious model registries, posing a risk to machine learning pipelines that process untrusted models.

CVSS 3.1 · 5.0 Medium EPSS < 1% KEV · Not listed
Vendors
Keras-team
Products
Keras
CVE-2026-64940

Permissive Regular Expression Enabling Management Console Login in Tegalog -Fumy Otegaru Memo Logger

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from the management console.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Nishishi Factory
Products
Tegalog -fumy Otegaru Memo Logger-
CVE-2026-21075

Improper Authorization in My Galaxy URL Scheme Enables Sensitive Data Access

Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Samsung Mobile
Products
My Galaxy
CVE-2026-21081

Local Android Component Export Leak in SamsungPassAutofill

Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Samsung Mobile
Products
Samsungpassautofill
CVE-2026-66405

Telnet Service Enabled on Deebot Pro M1 and K1VAC

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Ecovacs Robotics
Products
Deebot Pro K1vac Deebot Pro M1
CVE-2026-66406

Disabled SSL Validation in DEEBOT Pro Enables MITM and Remote Code Execution

DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Ecovacs Robotics
Products
Deebot Pro K1vac Deebot Pro M1
CVE-2026-66407

Improper WebSocket Authentication Enables Key Retrieval and Traffic Tampering on Deebot Pro M1 and K1VAC

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ecovacs Robotics
Products
Deebot Pro K1vac Deebot Pro M1
CVE-2026-66408

Weak Root Passwords Enable Physical Access Compromise on DEEBOT Pro M1 and K1VAC

The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ecovacs Robotics
Products
Deebot Pro K1vac Deebot Pro M1
CVE-2026-66409

Weak Wi‑Fi Hotspot Passwords Enable Unauthenticated Access on Deebot Robots

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ecovacs Robotics
Products
Deebot Pro K1vac Deebot Pro M1
CVE-2026-66411

Unauthenticated WebSocket Control of Ecovacs Deebot Robots

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ecovacs Robotics
Products
Deebot Pro K1vac Deebot Pro M1