Search vulnerabilities

Expected end of text, found ':' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,120

CVE-2026-91872

Insertion of Sensitive Information into Log Files in Dell Ansible Storage Configuration Module

Dell Ansible Storage for PowerStore, versions prior to 3.9.0,contains an Insertion of Sensitive Information into Log File vulnerability in the configuration module. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-91890

Improper Certificate Validation in Dell Ansible Storage for Unity Allowing Information Exposure

Dell Ansible Storage for Unity , versions prior to 1.2.13 contains an Improper Certificate Validation vulnerability in the UnityRESTConnector component. An unauthenticated attacker with remote access could potentially exploit this vulnerability,leading to information exposure and unauthorized access.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-91879

Log File Sensitive Data Exposure in Dell Terraform Providers

Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component.  A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-91880

Improper Certificate Validation in Dell Terraform Provider for PowerFlex Allows Unauthorized Access

Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an Improper Certificate Validation vulnerability in the SSH client component.Terraform PowerFlex provider uses ssh.InsecureIgnoreHostKey() as the default SSH host key callback. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.

CVSS 3.1 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-91891

Sensitive Authentication Data Insufficiently Redacted in Diagnostic Logs

Dell Terraform Provider for PowerStore, versions prior to 1.3.1 , contains a  vulnerability that may cause sensitive authentication data to be insufficiently redacted in diagnostic logs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-91892

Deprecated cryptographic protocols in Dell Terraform Provider for PowerFlex allow remote info exposure

Dell Terraform Provider for PowerFlex, versions prior to 1.9.0, contains a vulnerability  that may permit the use of deprecated cryptographic protocols during secure communications. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-91876

Improper Restriction of XML External Entity Reference in Dell OpenManage Ansible Modules Allows Local Information Exposure

Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity Reference vulnerability in the XML parsing component. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-91877

Improper Neutralization of Special Elements in OData Filter Processing Leading to Unauthorized Data Access

Dell OpenManage Ansible Modules, versions 2.0.2 through 10.0.3, contains an Improper Neutralization of Special Elements in Data Query Logic vulnerability in the OData filter processing component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized data access, authorization bypass, and denial of service.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-91873

Improper Certificate Validation in Dell OpenManage Ansible Modules

Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACRedfishAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-87801

API Framework Data Exposure in Synology DSM

An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-88266

Authenticated External Control of System Setting Enables File Write in Synology DSM

An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125438

WordPress RepairBuddy plugin <= 4.1235 - Broken Access Control vulnerability

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Webful Creations Wordpress-extensions
Products
Repairbuddy Repairbuddy
CVE-2026-124752

WordPress Element Pack Elementor Addons plugin <= 10.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Bdthemes Wordpress-extensions
Products
Element Pack Elementor Addons Element Pack Elementor Addons
CVE-2026-125437

WordPress Simply Schedule Appointments plugin <= 1.6.13.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.13.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nsquared Wordpress-extensions
Products
Simply Schedule Appointments Simply Schedule Appointments
CVE-2026-124416

WordPress WP Job Portal plugin <= 2.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ahmad Wordpress-extensions
Products
Wp Job Portal Wp Job Portal
CVE-2026-95948

Windows Graphics Kernel Elevation of Privilege Vulnerability

Stack-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Office Windows 10 1607 Windows 10 1809 and 11 more
CVE-2026-88217

Windows Graphics Kernel Information Disclosure Vulnerability

Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Office Office 365 Office Macos 2021 and 14 more
CVE-2026-96150

Microsoft Windows Codecs Library Information Disclosure Vulnerability

Use of uninitialized resource in Microsoft Windows Codecs Library allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Office Windows 10 1607 Windows 10 1809 and 11 more
CVE-2026-116663

Tanium addressed an improper access controls vulnerability in Enforce.

Tanium addressed an improper access controls vulnerability in Enforce.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tanium
Products
Enforce
CVE-2026-95953

Windows Graphics Kernel Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Office Office 365 Office Macos 2021 and 14 more