Search vulnerabilities

Expected end of text, found '–' (at char 55), (line:1, col:56)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,536

CVE-2025-12317

Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges

When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a result, a user can continue to perform unauthorized actions or access restricted resources until the expired tokens naturally expire.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Enterprise Integrator Identity Server Wso2 Enterprise Integrator and 1 more
CVE-2025-14561

Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Wso2 Api Control Plane Wso2 Api Manager Wso2 Carbon Api Management Implementation and 3 more
CVE-2026-71558

Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Fory
CVE-2026-3415

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges. Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Wso2 Api Control Plane Wso2 Api Manager Wso2 Carbon Api Gateway and 3 more
CVE-2026-3418

Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Api Control Plane Api Manager Carbon Api Management Api and 9 more
CVE-2024-6541

Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products

The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Micro Integrator Wso2-synapse Wso2 Api Manager and 2 more
CVE-2026-64652

GitHub CLI: Partial token disclosure in `gh auth status` output

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output that is captured or shared. Authenticated users are affected if they ran gh auth status (without the --show-token flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*; for example, ghs_<APPID>_<JWT>), as well as the Actions GITHUB_TOKEN. Classic tokens such as gho_* and ghp_* have an underscore-free body and are not affected. This issue is fixed in version 2.97.0.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Cli
Products
Cli
CVE-2026-71560

Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Fory
CVE-2026-19111

Insecure direct object reference in Strands Agents Tools memory tool namespace isolation

Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a forged namespace parameter. To remediate this issue, users should upgrade to version 0.8.3.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Strands-agents-tools
CVE-2026-48080

OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `GET /api/tenants/{id}` endpoint returns the full tenant record to any authenticated `TENANT_ADMIN` of that tenant, including the `databaseUrl` field. This field contains the live PostgreSQL connection string the application uses to connect to that tenant's database. In the tested official `docker-compose.prod.yml` deployment, the connection string contained the user `postgres` with `rolsuper=true` and the plaintext password from `secrets/postgres_password.txt`. Operators who configure a non-superuser PostgreSQL user via `secrets/postgres_user.txt` would expose a less privileged credential, but the disclosure of the connection string itself is independent of that choice. The same credential applies to every database managed by that PostgreSQL instance: the central `appointment_booking` database, every per-tenant database (one per tenant), and the postgres administrative database. A `TENANT_ADMIN` of one tenant who can reach `postgres:5432` (directly via internal network, indirectly via any SSRF, RCE, or file-read in the application) can read every other tenant's appointment ciphertexts, key shares, and metadata; read the central user table, including all `GLOBAL_ADMIN` accounts, password hashes, and session records; modify or delete any data in any tenant database; and/or i a superuser-scoped deployment: use PostgreSQL's `pg_read_server_files`, `COPY ... FROM PROGRAM`, and `CREATE EXTENSION` for further escalation inside the database container. This breaks the per-tenant database isolation that is otherwise the primary cross-tenant control in the application. The application code carefully scopes most queries to the calling tenant's database, but those scopings are irrelevant once the attacker holds the credentials that bypass the application entirely. Version 1.0.2 fixes the issue.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Open-reception
Products
Appointment-booking-software
CVE-2026-70557

diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck(), returns true unconditionally, so any authenticated user (including a zero-role account) can read @JsonIgnore-annotated secret fields such as IamAccount.authSecret and IamAccount.secretSalt for every account, or arbitrary secret fields of any other entity. Shiro's two-iteration MD5 with an 8-character salt is trivially crackable offline, so the disclosed admin password hashes convert to full administrative takeover. The endpoint is not example code; the official diboot-admin-ui frontend requires it, so deployments following the vendor's recommended integration expose it. The mechanism was renamed relatedData* to attachMore* on the development branch, but attachMoreSecurityCheck() also returns true unconditionally.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Diboot
Products
Diboot-core
CVE-2026-64663

Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose templates pass untrusted input into affected areas, and exploitation did not require authentication. This issue is fixed in versions 5.74.1 and 6.24.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Statamic
Products
Cms
CVE-2026-19069

itsourcecode Hospital Management System treatmentrecord.php sql injection

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /treatmentrecord.php. The manipulation of the argument editid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Itsourcecode
Products
Hospital Management System
CVE-2026-71437

Mermaid Architecture diagrams are vulnerable to prototype pollution

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of __proto__. Because the group id is used directly as an object property key without validation, an attacker who can supply diagram text can pollute Object.prototype, potentially affecting the behavior of the embedding application. This issue is fixed in version 11.16.1.

CVSS 4.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mermaid Project
Products
Mermaid
CVE-2026-14365

TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to change the password of arbitrary user accounts, including administrators, which can be leveraged to gain access to those accounts.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themetechmount Wordpress
Products
Truebooker-appointment-booking Wordpress
CVE-2026-19191

StableBit DrivePool DrivePoolService DrivePool.Service.exe permission

A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\StableBit\DrivePool\DrivePool.Service.exe of the component DrivePoolService. Such manipulation leads to permission issues. The attack must be carried out locally. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Stablebit
Products
Drivepool
CVE-2026-16619

miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress
Products
Miniorange 2fa Wordpress
CVE-2026-16620

WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select Mode

The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed prices and commit a real order at that price (revenue loss / underpriced orders). This is a distinct, unfixed vector from CVE-2025-12115, whose 2.2.0 fix only addressed applying a custom price to products where Name Your Price is disabled and left the Select-mode allowlist unenforced through 2.2.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpclever
Products
Wordpress Wpc Name Your Price For Woocommerce
CVE-2026-68823

Azure Confidential Ledger Remote Code Execution Vulnerability

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Confidential Ledger
CVE-2026-71555

PILOS: Reverse tabnabbing in room description

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Thm-health
Products
Pilos