Search vulnerabilities

Expected end of text, found '\u200b' (at char 19), (line:1, col:20)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,959

CVE-2026-48335

Illustrator | Out-of-bounds Write (CWE-787)

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe Microsoft
Products
Illustrator Illustrator Desktop 2025 Illustrator Desktop 2026 and 1 more
CVE-2026-48336

Illustrator | Out-of-bounds Write (CWE-787)

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe Microsoft
Products
Illustrator Illustrator Desktop 2025 Illustrator Desktop 2026 and 1 more
CVE-2026-46637

Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly escaped. This issue is fixed in version 3.26.0.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Symfony Twig Twigphp
Products
Twig Cssinliner-extra Markdown-extra and 1 more
CVE-2026-9770

Hardcoded Cryptographic Key Information Disclosure Vulnerability on TP-Link Kasa EC70 and EC71

Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices.  An attacker with access to the firmware image can extract the embedded key.  Successful exploitation may allow an unauthenticated attacker on the same network to use this key in the web management service, compromising the confidentiality of encrypted communications. This may enable passive decryption of traffic or active man-in-the-middle (MITM) attacks

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Kasa Ec70 Kasa Ec70 Firmware Kasa Ec70 V4 and 3 more
CVE-2026-13230

Information Disclosure Vulnerability in Local Discovery Response in TP-Link Kasa EC70 and EC71

An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on the same local network to retrieve geolocation-related data through crafted responses. The vulnerability impacts confidentiality only, with no evidence of integrity of availability impact.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Kasa Ec70 Kasa Ec70 Firmware Kasa Ec70 V4 and 3 more
CVE-2026-57832

Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9

Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 - The Joomla extension EDocman is vulnerable to an unauthenticated SQL injection.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Joomdonation.com
Products
Edocman Extension For Joomla
CVE-2026-57833

Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2

Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS in relation to the AI analysis feature.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Weeblr.com
Products
4analytics Extension For Joomla
CVE-2026-58077

Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2

Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS. A specially crafted unauthenticated request may result in website takeover under some circumstances.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Weeblr.com
Products
4analytics Extension For Joomla
CVE-2026-46458

Credential exposure in ICU Scandinavia Boomerang

ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. This allows an unauthenticated remote attacker to retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot. This issue has been fixed in version 2.4.18.029

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Icu Scandinavia
Products
Boomerang
CVE-2026-62294

Flameshot: OCTOU symlink attack via predictable /tmp path in Flameshot "Open With"

Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write. This issue is fixed in version 14.0.0.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Flameshot-org
Products
Flameshot
CVE-2026-9007

Reflected XSS in HCL Notes

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL Software allows reflected Cross-Site Scripting (XSS).  Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of another user. This issue affects HCL Notes: Release 12.0.2FP5HF8 on Linux 4.18.0-553.52.1.El8_10.X64_64#1.

CVSS 4.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcl Software
Products
Hcl Notes
CVE-2026-49997

SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted

SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purge_edges in surrealdb/core/src/doc/delete.rs automatically removed graph edge records with permissions disabled through opt.clone().with_perms(false) when a connected node was deleted, bypassing the edge table's PERMISSIONS FOR delete and PERMISSIONS FOR select clauses. This issue is fixed in version 3.1.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-52843

Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode

Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Lightpanda-io
Products
Browser
CVE-2026-65695

Office-Word-MCP-Server 1.1.11 Path Traversal via document tools

Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute paths or ../ traversal sequences directly to document open and save operations, bypassing the check_file_writeable and ensure_docx_extension helpers which perform no base-directory confinement or realpath validation.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Gongrzhe
Products
Office-word-mcp-server
CVE-2026-65696

Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API

Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can exploit the missing ownership check in the affected handlers to access target user records without the filteredFields filter, leaking sensitive data including email addresses and plexId values.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sct
Products
Overseerr
CVE-2026-65698

Void 1.3.4 Path Traversal via AI Agent File-Reading Tools

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file:// URIs through the read_file, ls_dir, get_dir_tree, and search_* tools, which lack workspace confinement and bypass the approval gate, enabling silent exfiltration of sensitive files such as SSH private keys or cloud credentials via subsequent tool calls.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Voideditor
Products
Void
CVE-2026-65699

AgentGPT 1.0.0 Authorization Bypass via Agent Task Creation

AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target run_id in the request body without ownership verification. The AgentCRUD.create_task and validate_task_count functions look up the target AgentRun using the client-supplied run_id without confirming the run belongs to the requesting user, enabling an attacker who obtains a valid run_id to corrupt task history, exhaust the per-run loop budget, and drive LLM costs against the victim's run.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Reworkd
Products
Agentgpt
CVE-2026-65701

SoftVC VITS Singing Voice Conversion Path Traversal via /wav2wav Flask Route

SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesystem paths through the audio_path field of an unauthenticated POST request to the /wav2wav route. Attackers can pass arbitrary server-side paths verbatim to librosa.load, torchaudio.load, and soundfile.write sinks, causing the server to decode and return file contents via the HTTP response body while also writing attacker-specified .wav files to arbitrary locations on the filesystem.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Svc-develop-team
Products
So-vits-svc
CVE-2026-47769

APIFold Vulnerable to Unauthenticated Webhook Event Injection

APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint. Prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5, the `/webhooks/:serverSlug/:eventName` endpoint accepts arbitrary unauthenticated JSON and stores it in Redis and the `webhook_events` PostgreSQL table without any signature check or authentication requirement. The root cause is that `createWebhookRouter` is called at `server.ts:188` without a `validators` map, so `receivers.ts:80`'s optional-chaining guard evaluates to `undefined` and the signature-validation block (`receiver.ts:81–95`) is unconditionally skipped. Any unauthenticated network client that knows a valid server slug can inject arbitrary payloads, which are subsequently served as trusted resource state to legitimate MCP clients. Commit 7f19b52280f414f57af2b79a95333d1c8fbeece5 patches the issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Work90210
Products
Apifold
CVE-2026-47722

nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, `internal/configgen/generator.go:86,108,119` interpolates the operator-supplied `ListenHost` and `TunDevice` fields raw into a `text/template` that produces the agent's `config.yml`. `internal/web/advanced.go:20-35` accepts both with only `strings.TrimSpace` — no character or shape validation. Version 0.3.2 fixes the issue.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Juev
Products
Nebula-mesh