Search vulnerabilities

Expected end of text, found 'èmes' (at char 20), (line:1, col:21)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,471

CVE-2026-126891

chromium-browser: chromium-browser: Use after free in V8

Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-126884

chromium-browser: chromium-browser: Out of bounds read in Skia

Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-18633

Uninitialized Pointer Vulnerability in Synology DSM NFS Service Leading to Denial of Service

An access of uninitialized pointer vulnerability in the nfsd in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to conduct denial-of-service attacks.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Synology
Products
Diskstation Manager
CVE-2026-19414

Missing Authorization in Promotion API Allows Authenticated File Write

A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Synology
Products
Diskstation Manager
CVE-2026-52786

BACnet Stack: malicious ReadPropertyMultiple-ACK with excessive properties causes global-buffer-overflow in ProcessRPMData()

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, in the official apps/epics client tool on v1.6.0-rc1 (not in the generic BACnet RPM ACK decoder alone) a malicious BACnet/IP endpoint can reply to the EPICS tool’s legitimate ReadPropertyMultiple request with a syntactically valid ReadPropertyMultiple-ACK that contains more heading properties than the tool’s fixed local storage can hold. The response is decoded successfully and later consumed by ProcessRPMData(), which writes property values into a fixed global array using an unbounded linear index. This results in a reproducible global-buffer-overflow in apps/epics/main.c. This is a network-reachable memory corruption in the official epics tool’s response-processing path. The root cause is that apps/epics treats a remotely supplied variable-length RPM property list as if it were a trusted, fixed-size local heading-property set. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack
CVE-2026-47259

BACnet Stack: Stack-based buffer overflow in Notification Class RemoveListElement recipient-list decoding

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a RemoveListElement request targeting Notification-Class.recipient-list can trigger a stack-based out-of-bounds write in the current master branch when the request contains more than NC_MAX_RECIPIENTS valid BACnetDestination elements. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.

CVSS 3.1 · 8.2 High EPSS n/a KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack
CVE-2026-47711

BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life_Safety_Zone.accepted-modes on the default BACnet/IP server

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-reference to point to life-safety-zone-1 / accepted-modes. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.

CVSS 3.1 · 8.6 High EPSS n/a KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack
CVE-2026-15198

WebDAV API Missing Authentication Allows Unauthorized File Read

A missing authentication for critical functionality vulnerability in the Webdav API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to read specific files and conduct limited denial-of-service attacks.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Synology
Products
Diskstation Manager
CVE-2026-127111

SOGo before 5.12.13 Unauthenticated Password Recovery Brute Force

SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.

CVSS 4.0 · 9.1 Critical EPSS n/a KEV · Not listed
Vendors
Alinto
Products
Sogo
CVE-2026-127145

SOGo before 5.12.13 SSRF via Web Calendar Subscriptions

SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Alinto
Products
Sogo
CVE-2026-127202

MLflow < 3.18.0 Path Traversal via model_id in log_outputs API

MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated remote attackers to write files outside the intended run directory by supplying a malicious model_id parameter to the log outputs API. Attackers can exploit the unvalidated model_id containing ../ sequences via the POST /api/3.0/mlflow/runs/outputs endpoint to create directories and write a meta.yaml file at arbitrary filesystem locations, limited only by the server account's permissions. FileStore was the default backend before 3.7.0 and is opt-in afterward through MLFLOW_ALLOW_FILE_STORE.

CVSS 4.0 · 6.3 Medium EPSS n/a KEV · Not listed
Vendors
Mlflow
Products
Mlflow Mlflow/mlflow
CVE-2026-121876

Sandboxed-containers: kernel: systemd-gpt-auto-generator: guest data leakage in confidential computing (sandboxed containers)

A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers (confidential peer pods). systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type GUID at boot with no user confirmation. In the confidential computing threat model, where the host/hypervisor is the adversary, a malicious host can inject partitions into the guest's virtual disk. Most critically, injecting a swap partition causes the guest kernel to page out TEE-encrypted memory to a host-controlled block device, breaking the confidentiality guarantee of the hardware TEE (AMD SEV-SNP, Intel TDX). The PodVM images use a GPT-partitioned disk with dm-verity on the root partition. However, the roothash= kernel parameter only disables root auto-discovery — non-root partitions (swap, /home, /var, /srv, /var/tmp) are still auto-discovered and mounted. The generator is shipped unmasked in the RHEL systemd-udev subpackage, and no kernel command line parameter in the measured UKI addon disables it. Additionally, the PodVM measurement script captures PCRs 3, 9, 11, and 12, but not PCR 5 (GPT partition table), so partition table modifications are not detected by remote attestation.

CVSS 3.1 · 7.9 High EPSS n/a KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Openshift and 2 more
CVE-2026-127236

OpenNMS argument injection in ad-hoc RRD graphs

An argument injection vulnerability exists in the ad-hoc RRD graph feature of multiple versions of OpenNMS Meridian and Horizon. The ad-hoc graph endpoint (GET /graph/graph.png?adhoc=true) copies request parameters into the rrdtool command line without validation. A low-privileged authenticated user (ROLE_USER or ROLE_DASHBOARD) can insert extra rrdtool arguments. An injected --daemon argument makes the server connect to an attacker-chosen address, which is a server-side request forgery. An injected DEF statement reads a local RRD file by absolute path. The command runs through exec with an argument array and no shell, so arbitrary operating system command execution is not possible. The fix validates the ad-hoc graph parameters against allowlists. The solution is to upgrade to Meridian 2024.3.15, 2025.0.12, 2026.0.2 and Horizon 36.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 5.4 Medium EPSS n/a KEV · Not listed
Vendors
Opennms The Opennms Group
Products
Horizon Meridian Horizon and 1 more
CVE-2026-45265

Atomic-Read-File RecordCount Stack-Based Out-of-Bounds Write in bacnet-stack

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a stack-based out-of-bounds write / stack-buffer-overflow in bacnet-stack when the server processes a malicious Atomic-Read-File request in record access mode. The bug is triggered on the real server side. A crafted request can set an excessively large RecordCount, which is later used as the loop bound for writing record data into a stack-allocated BACNET_ATOMIC_READ_FILE_DATA data structure. However, the stack object only has space for one fileData element. When the loop reaches i = 1, the code computes &data->fileData[1], which is already out of bounds, and the resulting invalid pointer is passed down to memmove(), causing a stack-buffer-overflow. This issue has been patched in versions 1.4.4 and 1.5.1.

CVSS 3.1 · 8.2 High EPSS n/a KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack
CVE-2026-126885

chromium-browser: Use after free in ServiceWorker

Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-126895

chromium-browser: chromium-browser: Use after free in CSS

Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-126911

chromium-browser: chromium-browser: Use after free in Accessibility

Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-126889

chromium-browser: chromium-browser: Arbitrary code execution in V8 via crafted HTML page

Off-by-one error in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-126886

chromium-browser: chromium-browser: arbitrary code execution via use-after-free in Frames

Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome