Search vulnerabilities

Expected end of text, found '–' (at char 33), (line:1, col:34)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,471

CVE-2026-123205

accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql

accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that allows unauthenticated remote peers to overflow fixed heap buffers by producing log lines exceeding LOG_MAX_SIZE. Attackers within client-ip-range can send an L2TP Start-Control-Connection-Request with many string AVPs when verbose logging is enabled to corrupt heap memory and crash the daemon.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Accel-ppp
Products
Accel-ppp
CVE-2026-123204

Posta before v0.18.0 SSRF via Webhook URL

Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Goposta
Products
Posta
CVE-2026-123201

buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API

Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jarun
Products
Buku
CVE-2026-123200

VRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION length index

VRPN through 07.36 contains an out-of-bounds stack write vulnerability in vrpn_Endpoint::handle_sender_message() and handle_type_message() that allows unauthenticated remote peers to write outside a stack buffer via an unchecked length index. Attackers can connect, complete the version-cookie exchange, and send a SENDER_DESCRIPTION or TYPE_DESCRIPTION message with an out-of-range or negative index to crash the process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Vrpn
Products
Vrpn
CVE-2026-123197

WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files

WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file<timestamp>.webp requests to retrieve stickers from any session, bypassing per-session token checks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wppconnect
Products
Wppconnect-server
CVE-2026-123196

Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadata

Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Authorizerdev
Products
Authorizer
CVE-2026-123135

langgenius dify Sandbox Run __init__.py hard-coded credentials

A vulnerability was found in langgenius dify up to 1.18.0/2.0.0-beta.2. Affected by this vulnerability is an unknown functionality of the file api/configs/feature/__init__.py of the component Sandbox Run Handler. The manipulation results in hard-coded credentials. The attack can be launched remotely. The exploit has been made public and could be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Langgenius
Products
Dify
CVE-2026-121995

Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail

A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Hardened Images and 2 more
CVE-2026-115554

Tivoli Netcool/OMNIbus Web GUI is vulnerable to stored cross-site scripting

IBM Tivoli Netcool/OMNIbus 8.1.0 through 8.1.0.41 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Tivoli Netcool\/omnibus Tivoli Netcoolomnibus
CVE-2026-114134

Black: GitHub Action installs unvalidated required-version from pyproject.toml

Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull request can change that field to a direct reference to attacker-controlled code, causing the workflow to install and execute the code in the victim repository's GitHub Actions context. This issue is fixed in version 26.10.1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Psf
Products
Black
CVE-2026-113663

AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=[...] or readonly=True rely on ShellAdapter._filter and contains_shell_operator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate a command prefix and reject selected shell syntax. The filter omits newline and carriage-return separators, while the accepted raw string is passed to sh -c, allowing an attacker-influenced agent command to execute an additional arbitrary statement. With the default LocalEnvironment backend, the injected statement runs as a host subprocess with the privileges of the agent process and can affect confidentiality, integrity, and availability. This issue is fixed in ag2 version 1.1.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ag2ai
Products
Ag2 Autogen
CVE-2026-112938

filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, On POSIX platforms, StrictSoftFileLock and AsyncStrictSoftFileLock validate the coordination directory in _ensure_protocol_directory but later reach the claims directory through _open_directory by pathname, allowing a local account that can rename the coordination name to swap in a symbolic link between check and use during acquisition. That race can create and leave claim files in another writable directory or strand claims in a different strict lock so the second lock times out. Separately, the claims property and force_break follow a resting symbolic link without a race when the lock user inspects or recovers the lock. Claims inspection discloses a file name to the other account only if the resulting exception text or claim_name reaches that account through a shared log, CI output, or error report. A blind force_break recovery that removes live claims from another strict lock can allow two processes into that lock's critical section; this path reaches other strict locks, not arbitrary files. This issue is fixed in version 4.2.1.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tox-dev
Products
Filelock
CVE-2026-112205

Bruteforce Protection Bypass in WidzialniCMS

WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts. This issue has been fixed in version 2.5.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Fundacja Widzialni
Products
Widzialnicms
CVE-2026-112204

Reflected XSS in WidzialniCMS

WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft. This issue has been fixed in version 2.5.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Fundacja Widzialni
Products
Widzialnicms
CVE-2026-111768

Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of array elements and object keys validated in one request. The affected surface is validation of HTTP requests containing arrays or object keys. The trigger is an array-element or object-key validation workload large enough to exhaust memory while remaining within the request size limit. A single request within the default 4 MiB limit can terminate the process with JavaScript heap exhaustion. No credentials are required unless the application authenticates before SDK processing. Tools accepting arrays or records carry the greatest risk. stdio-only servers do not expose the HTTP request path. Upgrading alone does not enable the new validation bound. Operators must configure both a tool-input element bound and an appropriate request body size limit. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-110931

Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop

A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-110469

Remote Code Execution via Unrestricted File Upload in WidzialniCMS

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Fundacja Widzialni
Products
Widzialnicms
CVE-2026-110468

Remote Code Execution via Unrestricted File Upload in WidzialniCMS

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Fundacja Widzialni
Products
Widzialnicms
CVE-2026-104269

ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Modsecurity
Products
Modsecurity
CVE-2026-103932

ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Modsecurity
Products
Modsecurity