Search vulnerabilities

Expected end of text, found '\u200b' (at char 19), (line:1, col:20)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,959

CVE-2026-12991

Multiple vulnerabilities in Ghost Robotics' Vision 60

The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot (APK v5.5.0) exposes the system to man-in-the-middle attacks. An attacker located on the local network can use ARP spoofing and selective traffic blocking techniques to intercept and manipulate packets between the legitimate operator and the robot. This allows the attacker to disconnect the original controller, establish unauthorized communications, and prevent the operator from regaining control of the device, seriously compromising the confidentiality, integrity, and availability (CIA) of operations.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Ghost Robotics
Products
Vision 60
CVE-2026-60585

mysql: Replication unspecified vulnerability (CPU Jul 2026)

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Mysql Cluster Mysql Server
CVE-2026-57396

WordPress Free Gifts for WooCommerce plugin <= 13.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flintop Free Gifts for WooCommerce free-gifts-for-woocommerce allows Stored XSS.This issue affects Free Gifts for WooCommerce: from n/a through <= 13.1.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Flintop Wordpress
Products
Free Gifts For Woocommerce Wordpress
CVE-2026-57705

WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Nexcess Wordpress
Products
Event Tickets Wordpress
CVE-2026-57787

WordPress CWS SVGicons plugin <= 1.5.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeWS CWS SVGicons cws-svgicons allows Blind SQL Injection.This issue affects CWS SVGicons: from n/a through <= 1.5.5.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Creativews Wordpress
Products
Cws Svgicons Wordpress
CVE-2026-15981

SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Cyberlord92 Wordpress
Products
Oauth Single Sign On – Sso (oauth Client) Wordpress
CVE-2026-24727

SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive containing a server-executable file.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Sun.net
Products
Corporate Training Management System
CVE-2026-15243

Improper Validation of Certificate in CAS Client

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) can provide any CA-signed certificate for a hostname that matches the configured allowlist or regex. This can lead to intercepting the CAS exchange, capturing the Ticket-Granting Ticket (TGT), and subsequently obtaining Service Tickets on behalf of the victim.  Because maintainers contact attempts were unsuccessful, vulnerabilities have only been confirmed in version 4.1.0 (Java Apereo CAS Client) and 3.6.4 (Jasig CAS Client) but may also affect other versions.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Apereo
Products
Jasig Cas Client Java Cas Client
CVE-2026-66143

Apache Neethi: Missing global alternative-output budget across policy computation paths

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Neethi
CVE-2026-66144

Apache Neethi: Remote PolicyReference fetch lacks resource bounds

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximum size on data read from remote policy references.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Neethi
CVE-2026-45812

Apache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report Handler

Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the buffer and deliver a GAP event with bogus data to the application. Severity is low: NimBLE's own controller never batches multiple reports into one event, so this only matters when NimBLE's host is paired with a third-party controller that does. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Nimble
CVE-2026-45815

Apache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handler

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Apache
Products
Nimble
CVE-2026-9765

CVE-2026-9765 CVE Record

Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. Broken access control can allow attackers to: Access resources only accessible to certain users, thus allowing unauthorized access to data Perform operations on behalf of other users, leading to account takeovers in the worst cases Attempt privilege escalation Attempt to take over an account

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2026-12496

Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server

Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Loytec
Products
L-dali L-gate L-inx and 5 more
CVE-2026-12502

Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo

Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Loytec
Products
L-dali L-gate L-inx and 5 more
CVE-2026-12503

Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter

Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Loytec
Products
L-dali L-gate L-inx and 5 more
CVE-2026-12504

Loytec LINX firmware: Improper Authentication in PAM configuration

Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Loytec
Products
L-dali L-gate L-inx and 5 more
CVE-2026-55728

Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict

Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.

CVSS 4.0 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Loytec
Products
L-dali L-gate L-inx and 5 more