Search vulnerabilities

Expected end of text, found '\' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,868

CVE-2026-19037

WonderTrader Internal Limit Order Book Cache MatchEngine.cpp update_lob behavioral workflow

A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::update_lob of the file src/WtBtCore/MatchEngine.cpp of the component Internal Limit Order Book Cache Handler. This manipulation causes enforcement of behavioral workflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wondertrader
Products
Wondertrader
CVE-2026-66273

Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Qpid Proton-j
CVE-2026-71315

Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for CVE-2026-53721. This issue is fixed in 3.21.10 and 4.5.1.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Nuxt
Products
Nuxt
CVE-2026-71309

rclone: Incomplete path validation allows backend root escape in serve restic

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Rclone
Products
Rclone
CVE-2026-71321

Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Nuxt
Products
Nuxt
CVE-2026-67588

Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustion

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Qpid Proton-j Qpid Protonj2
CVE-2026-71314

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Nuxt
Products
Nuxt
CVE-2026-18954

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic. To remediate this issue, users should upgrade to version 1.0.12 or later.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Amazon Aws
Products
Documentdb Mcp Server Documentdb-mcp-server
CVE-2026-71320

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Nuxt
Products
Nuxt
CVE-2026-18968

ttttonyhe OBlog tags.php cross site scripting

A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ttttonyhe
Products
Oblog
CVE-2026-18976

NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function get_tool_definitions of the file agent/agent_init.py of the component disabled_toolsets Handler. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nousresearch
Products
Hermes-agent
CVE-2026-18993

NousResearch hermes-agent Memory Toolset model_tools.py access control

A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/model_tools.py of the component Memory Toolset. The manipulation results in improper access controls. The attack can be executed remotely. The exploit is now public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nousresearch
Products
Hermes-agent
CVE-2026-67465

Apache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustion

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Qpid Proton-dotnet Qpid Proton Dotnet
CVE-2026-68074

Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Qpid Broker-j
CVE-2026-19000

JeecgBoot Anonymous Chat Attachment send server-side request forgery

A vulnerability was identified in JeecgBoot up to 3.9.2. The affected element is an unknown function of the file /airag/chat/send of the component Anonymous Chat Attachment Parser. The manipulation leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly available and might be used. A fix is planned for the upcoming release.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecgboot
Products
Jeecgboot
CVE-2026-66257

Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Qpid Proton-j
CVE-2026-71191

openstack-swift: openstack-swift: S3API presigned URL unsigned header authorization bypass

In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack
Products
Swift
CVE-2026-71190

openstack-swift: openstack-swift: Unauthenticated denial of service via catastrophic backtracking in Accept header parser

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Openstack
Products
Swift
CVE-2026-19009

TinyAGI Message API Endpoint response.ts collectFiles file inclusion

A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core/src/response.ts of the component Message API Endpoint. This manipulation causes file inclusion. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tinyagi
Products
Tinyagi
CVE-2026-18597

Blind SSRF on Foxit PDF Services API

The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Foxitsoftware
Products
Foxit Pdf Services Api