Search vulnerabilities

Expected end of text, found '/' (at char 41), (line:1, col:42)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,894

CVE-2026-16628

oclif JIT Plugin Entry child_process.exec os command injection

A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function child_process.exec of the component JIT Plugin Entry Handler. Performing a manipulation of the argument jitPlugins results in os command injection. The attack is only possible with local access. The exploit is now public and may be used. The patch is named 939b045725e065baebc4587b8bccfd56731eed3d. To fix this issue, it is recommended to deploy a patch.

CVSS 4.0 · 4.8 Medium EPSS 1.1% KEV · Not listed
Vendors
Oclif
Products
Oclif
CVE-2026-15761

Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reachable by users holding the plugin's custom Staff role, as the plugin's add_required_capabilities() function grants that role the edit_tc_tickets_instances capability, providing access to the tc_tickets_instances admin list screen where the filter is applied.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tickera Wordpress
Products
Tickera – Sell Tickets & Manage Events Wordpress
CVE-2026-65901

DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Cure53
Products
Dompurify
CVE-2026-65913

DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Cure53
Products
Dompurify
CVE-2026-25466

WordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpgmaps
Products
Wordpress Wp Go Maps
CVE-2026-61944

WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Bookly Wordpress
Products
Bookly Wordpress
CVE-2026-9058

Improper Certificate Verification in Szafir SDK

For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trust store as a "nonqualified" certificate. In such a case, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nonqualified". For other types of untrusted certificates, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nondetermined". This may lead integrating applications to incorrectly treat the digital signature as valid despite an untrusted certificate chain. This flaw enables authentication bypass and user impersonation: (1) in use-cases other than qualified certificate authentication, or (2) if the qualified certificate authentication use-case is not correctly implemented by the integrating application. This issue was fixed in version 1.8.463.2.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Krajowa Izba Rozliczeniowa
Products
Szafir Sdk
CVE-2026-47708

MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the `log_file_name` parameter in the `stata_do` API and CLI is directly interpolated into a Stata command string without sanitization. The security guard (`GuardValidator`) only scans the do-file content but does not validate this parameter. An attacker can inject arbitrary Stata commands (including `shell`, `python`, `erase`, etc.) by crafting a malicious `log_file_name` containing quotes, newlines, or Stata command separators. Version 1.17.3 contains a patch for the issue.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Sepinetam
Products
Stata-mcp
CVE-2026-9472

dazeb markdown-downloader index.ts create_subdirectory path traversal

A flaw has been found in dazeb markdown-downloader up to 3d4394b34b6c99d81af817623af55e3384df5a6a. Affected is the function download_markdown/list_downloaded_files/create_subdirectory of the file src/index.ts. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dazeb
Products
Markdown-downloader
CVE-2026-9482

Edimax EW-7438RPn formSDHCP stack-based overflow

A vulnerability has been found in Edimax EW-7438RPn 1.31. This impacts the function formSDHCP of the file /goform/formSDHCP. Such manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Edimax
Products
Ew-7438rpn
CVE-2026-9447

SourceCodester Simple POS and Inventory System search.php sql injection

A vulnerability was found in SourceCodester Simple POS and Inventory System 1.0. The impacted element is an unknown function of the file /user/search.php. Performing a manipulation of the argument Name results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sourcecodester
Products
Simple Pos And Inventory System
CVE-2026-9382

Edimax BR-6675nD POST Request formPPTPSetup buffer overflow

A flaw has been found in Edimax BR-6675nD 1.12. Affected by this issue is the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request Handler. Executing a manipulation of the argument pptpUserName can lead to buffer overflow. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Edimax
Products
Br-6675nd
CVE-2026-8479

Null Pointer Dereference in IEC 60870-5-104 Bidirectional Mode Leading to Denial of Service

IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence of messages is sent for a certain time, causing Denial of Service impact. Product is only affected if IEC 60870-5-104 functionality in bidirectional mode (BCI) is configured.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hitachienergy
Products
Rtu500 Firmware
CVE-2026-53901

Cerebrate before v1.37 allows mass assignment of record identifiers during object creation

Cerebrate before version 1.37 contains a mass-assignment vulnerability in the generic CRUD add path. The add() handler attempted to remove an attacker-supplied id from $params before normalizing the request through __massageInput(). Because the normalized $input could still contain an id field, a user able to reach an affected add endpoint could supply an identifier that should have been server-controlled. Successful exploitation could allow creation of objects with attacker-chosen identifiers, potentially causing unauthorized data manipulation, object spoofing, inconsistent references, or disruption through identifier collisions, depending on the affected model and endpoint permissions. The issue was fixed in v1.37 by removing id from the normalized input before entity patching.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Cerebrate-project
Products
Cerebrate
CVE-2026-9735

Keyfile contents are in MongoDB Server logs

MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-9740

Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow

A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-9754

Stack memory disclosure in filemd5 command

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb
CVE-2026-8613

aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting

The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title_tag' Widget Setting in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This affects the Posts Timeline widget as well as the Posts Carousel widget across its default, Banner, and Modern skins, all of which omit the whitelist validation that is correctly applied in the Posts List widget.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Athemes Wordpress
Products
Athemes Addons For Elementor Wordpress