Search vulnerabilities

Expected end of text, found '–' (at char 55), (line:1, col:56)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-58628

Windows Wireless Network Manager Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Wireless Networking allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 13 more
CVE-2026-58633

Desktop Window Manager Elevation of Privilege Vulnerability

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 11 26h1 Windows 11 26h1
CVE-2026-58634

Desktop Window Manager Elevation of Privilege Vulnerability

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 11 26h1 Windows 11 26h1
CVE-2026-56181

Windows Network Address Translation (NAT) Spoofing Vulnerability

Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 and 5 more
CVE-2026-15209

JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Jshelpdesk Wordpress
Products
Jshelpdesk Wordpress
CVE-2026-14817

Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes

The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary JavaScript that executes in the session of any visitor who views the affected content.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bdthemes Wordpress
Products
Element Pack Addons For Elementor Wordpress
CVE-2026-16540

Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint

The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Nsqua Wordpress
Products
Simply Schedule Appointments Wordpress
CVE-2026-16532

Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Link Library Project Wordpress
Products
Link Library Wordpress
CVE-2026-58041

nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nodejs
Products
Nodejs
CVE-2026-58045

nodejs: Node.js: Denial of Service vulnerability

A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Nodejs
Products
Nodejs