Search vulnerabilities

Expected end of text, found '\' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,863

CVE-2026-54419

PIAF-HMS multiple unauthenticated SQL injection vulnerabilities via mysql_query

claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query calls via string concatenation, without sanitization, escaping, or parameterization.

CVSS 4.0 · 9.3 Critical EPSS 1.5% KEV · Not listed
Vendors
Claudiopizzillo
Products
Piaf-hms
CVE-2026-54418

Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed methods in the same dispatcher).

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Leantime
Products
Leantime
CVE-2026-54417

Integer Overflow in rxi/microtar mtar_next() Causes Infinite Loop DoS

An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU consumption / infinite loop) via a crafted tar archive. mtar_next computes the offset to the next record as round_up(h.size, 512) + sizeof(mtar_raw_header_t) using 32-bit arithmetic.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Rxi
Products
Microtar
CVE-2026-54416

Pluck CMS - Unrestricted File Upload via Missing .php8 Extension in Upload Blacklist

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Pluck-cms
Products
Pluckcms
CVE-2026-54415

Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover

Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Azuriom
Products
Azuriom
CVE-2026-54414

FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover

FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %).

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Error311
Products
Filerise
CVE-2026-54413

iso14229 Integer Underflow and Out-of-Bounds Read in Handle_0x27_SecurityAccess()

driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message.

CVSS 4.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Driftregion
Products
Iso14229
CVE-2026-54411

Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux-pam
Products
Linux-pam
CVE-2026-54410

nanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length Field

nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255.

CVSS 4.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debevv
Products
Nanomodbus
CVE-2026-4809

Unsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediable

plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while declaring a benign image MIME type, resulting in arbitrary file upload.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Plank
Products
Laravel-mediable
CVE-2026-3945

tinyproxy Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of Service

An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tinyproxy
Products
Tinyproxy
CVE-2026-31850

Plaintext Storage of Credentials in Configuration Backup in Nexxt Nebula 300+

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 stores sensitive information, including administrative credentials and WiFi pre-shared keys, in plaintext within exported configuration backup files. These backup files can be obtained through legitimate functionality or other weaknesses and do not apply encryption or hashing, allowing attackers to directly extract sensitive information.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Nexxtsolutions
Products
Nebula300+ Nebula300plus Nebula300plus Firmware
CVE-2026-31849

Missing CSRF Protection on Administrative Endpoints in Nexxt Nebula 300+

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing endpoints such as /goform/setSysTools and other administrative interfaces. As a result, an attacker can craft malicious web requests that are executed in the context of an authenticated administrator’s browser, leading to unauthorized configuration changes, including enabling services or modifying system settings.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Nexxtsolutions
Products
Nebula300+ Nebula300plus Nebula300plus Firmware
CVE-2026-31848

Reversible ecos_pw Cookie Allows Authentication Bypass in Nexxt Nebula 300+

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid cookie value without proper authentication.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Nexxtsolutions
Products
Nebula300+ Nebula300plus Nebula300plus Firmware
CVE-2026-31847

Hidden Functionality Enables Remote Telnet Activation via /goform/setSysTools in Nexxt Nebula 300+

Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnetPwd, an authenticated attacker can activate a Telnet service on port 23.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Nexxtsolutions
Products
Nebula300+ Nebula300plus Nebula300plus Firmware
CVE-2026-31846

Unauthenticated Credential Disclosure via /goform/ate in Nexxt Nebula 300+

Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attacker to retrieve sensitive device information, including the administrator password. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Nexxtsolutions
Products
Nebula300+
CVE-2026-31845

Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint

A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Rukovoditel
Products
Rukovoditel
CVE-2026-31844

Authenticated SQL Injection in Koha displayby parameter of suggestion.pl

An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Koha Koha-community
Products
Koha Koha
CVE-2026-31843

goodoneuz/pay-uz Unauthenticated PHP File Overwrite via /payment/api/editable/update Leading to Remote Code Execution

The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.

CVSS 4.0 · 10 Critical EPSS 1.4% KEV · Not listed
Vendors
Goodoneuz
Products
Pay-uz
CVE-2026-31842

Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling

Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tinyproxy Project
Products
Tinyproxy