Search vulnerabilities

Expected end of text, found '/' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,948

CVE-2026-32825

dataCycle No Brute-Force Protection On Web And API Login Endpoints

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise's `:lockable` module on the user model but explicitly disables both lock and unlock strategies, and no request throttling or rate-limiting layer was identified in the Rails code. This creates a direct online password-guessing risk: - valid user accounts can be attacked continuously without temporary lockout - the same weakness is reachable through both `/users/sign_in` and `/api/v4/auth/login` - successful guessing yields a normal session cookie in the HTML flow or a fresh JWT in the API flow - the API endpoint is especially attractive for automation because it requires no CSRF token This has been patched in version 26.06.08.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Datacycle-engine
Products
Datacycle-core
CVE-2026-39879

SQL injection in syslog-ng SQL destionation driver

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Syslog-ng
Products
Syslog-ng
CVE-2026-46715

Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth identity. The victim session is then treated as recently reauthenticated, allowing freshness-protected account actions to proceed. Version 5.8.1 contains a fix for this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pallets-eco
Products
Flask-security-too
CVE-2026-60028

Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1

Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Themexpert.com
Products
Quix Page Builder Pro Extension For Joomla
CVE-2026-60032

Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0

Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible (incl. polyglot filenames); chmod didn't strip execute bits.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Themexpert.com
Products
Jmedia Extension For Joomla
CVE-2026-60033

Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0

Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Themexpert.com
Products
Jmedia Extension For Joomla
CVE-2026-60030

Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1

Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Themexpert.com
Products
Quix Page Builder Pro Extension For Joomla
CVE-2026-60034

Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0

Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to a stored XSS vulnerability. Unsanitised SVG uploads served without nosniff, leading to stored/reflected XSS.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Themexpert.com
Products
Jmedia Extension For Joomla
CVE-2026-60026

Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1

Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user (core.create/core.edit) could inject PHP tags in element content, that got executed via view-cache include(). Requires caching on (default).

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Themexpert.com
Products
Quix Page Builder Pro Extension For Joomla
CVE-2026-60029

Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1

Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder users could break out of id/class fields that render for public users.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Themexpert.com
Products
Quix Page Builder Pro Extension For Joomla
CVE-2026-60031

Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1

Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an information disclosure. Raw exceptions reflected in AJAX handler responses.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Themexpert.com
Products
Quix Page Builder Pro Extension For Joomla
CVE-2026-60027

Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1

Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Themexpert.com
Products
Quix Page Builder Pro Extension For Joomla
CVE-2026-61901

Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2

Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 - The Joomla extension Hikashop is vulnerable to an open redirect.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hikashop.com
Products
Hikashop Extension For Joomla
CVE-2026-61424

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Dj-extensions.com
Products
Dj-classifieds Extension For Joomla
CVE-2026-63730

HyperDX < 2.31.0 SSRF via Webhook Test Endpoint

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hyperdxio
Products
Hyperdx
CVE-2026-63731

HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist enforcement. Attackers can exploit the reflected error responses from the endpoint to disclose internal service response bodies, enabling access to internal APIs, container services, and cloud provider metadata endpoints.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hyperdxio
Products
Hyperdx
CVE-2026-61425

Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0

Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Balbooa.com
Products
Gridbox Extension For Joomla
CVE-2026-44584

Paymenter doesn't reset email verification status after email change

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified status after switching to an unverified or unowned email address. When a user updated their email address, the system did not reset or revalidate the associated email verification status. As a result, the verification column remained set to “true” even after the email address was changed. Exploitation could potentially result in: misrepresentation of email ownership, bypass of verification-based trust assumptions, and abuse of features gated behind verified status. No direct unauthorized access to other users accounts or data is possible through this issue alone. This issue has been fixed in version 1.5.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Paymenter
Products
Paymenter
CVE-2026-44583

Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request destinations. This value is passed directly into a server-side HTTP request via file_get_contents, allowing attackers to control the destination of the request. No allowlist, validation, or signature verification is applied to the header before usage. As a result, the application can be coerced into performing HTTP requests to attacker-controlled or internal network destinations. This vulnerability allows remote unauthenticated attackers to induce server-side HTTP GET requests to arbitrary external or internal endpoints. Depending on network configuration, this may lead to: blind SSRF to external attacker-controlled systems, and potential access to internal network services No direct response data is returned to the attacker (blind SSRF), but the issue may still enable sensitive network probing or data exfiltration via side channels. This issue has been fixed in version 1.5.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Paymenter
Products
Paymenter
CVE-2026-44585

Paymenter: Broken object level authorization via service reference manipulation on ticket creation

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing services belonging to other accounts by modifying the service ID in the request. An attacker could modify the service ID value in the client-side request and successfully create a ticket associated with another user's service. The vulnerability requires authentication and does not provide direct access to service contents or customer data. However, referenced service information could become visible to support personnel handling the ticket. Successful exploitation could allow an authenticated user to: create support tickets referencing services belonging to other users, potentially cause support staff to interact with or review unrelated customer services. The vulnerability did not allow direct access to another user's service, modification of another user's service or retrieval of confidential service data through the vulnerable endpoint itself. This issue has been fixed in version 1.5.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Paymenter
Products
Paymenter