Search vulnerabilities

Expected end of text, found ':' (at char 23), (line:1, col:24)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,866

CVE-2026-9765

CVE-2026-9765 CVE Record

Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. Broken access control can allow attackers to: Access resources only accessible to certain users, thus allowing unauthorized access to data Perform operations on behalf of other users, leading to account takeovers in the worst cases Attempt privilege escalation Attempt to take over an account

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2026-12496

Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server

Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Loytec
Products
L-dali L-gate L-inx and 5 more
CVE-2026-12502

Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo

Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Loytec
Products
L-dali L-gate L-inx and 5 more
CVE-2026-12503

Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter

Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Loytec
Products
L-dali L-gate L-inx and 5 more
CVE-2026-12504

Loytec LINX firmware: Improper Authentication in PAM configuration

Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Loytec
Products
L-dali L-gate L-inx and 5 more
CVE-2026-55728

Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict

Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.

CVSS 4.0 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Loytec
Products
L-dali L-gate L-inx and 5 more
CVE-2026-55731

Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent

Unchecked input for loop condition (CWE-606) in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Loytec
Products
L-dali L-gate L-inx and 5 more
CVE-2026-49326

Apache HBase: Missing scanner instance owner check in thrift delegation service

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side. We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users. This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*. Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Hbase
CVE-2026-61892

Weintek cMT3092X Incorrect Permission Assignment for Critical Resource

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Weintek
Products
Cmt3092x Firmware Easyweb
CVE-2026-60134

Weintek cMT3092X Reliance on Cookies without Validation and Integrity Checking in a Security Decision

Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Weintek
Products
Cmt3092x Firmware Easyweb
CVE-2026-14837

SSH Enablement Signature Verification Bypass

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorized administrative access and complete system compromise.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Lenze
Products
C430 C4xx Firmware C550 and 4 more
CVE-2026-65764

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.1

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Phoca
Products
Phoca Commander Extension For Joomla
CVE-2026-65765

Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.1

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Phoca
Products
Phoca Commander Extension For Joomla
CVE-2026-48144

Apache Thrift: c_glib TLS Client Missing Hostname Verification

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2026-55969

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVSS 4.0 · 8.7 High EPSS 1.0% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2026-66053

Apache Thrift: Python TSSLSocket Hostname Matcher Import

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2026-10819

Mattermost Server Denial of Service via Animated GIF Emoji Upload

Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom emoji.. Mattermost Advisory ID: MMSA-2026-00695

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server