Search vulnerabilities

Expected end of text, found '–' (at char 41), (line:1, col:42)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,120

CVE-2026-5730

IDOR in Idvlabs' Ontime

Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers. This issue affects Ontime: through 04052026.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Idvlabs
Products
Ontime
CVE-2026-5799

IDOR in Idvlabs' Ontime

Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers. This issue affects Ontime: through 04052026.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Idvlabs
Products
Ontime
CVE-2026-7380

HTML Injection in Armiya Technologies' Access Control System

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows XSS Targeting HTML Attributes. This issue affects Access Control System (GKS): before Version 2.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Armiya
Products
Access Control System (gks)
CVE-2026-8306

Stored XSS in Armiya Technologies' Access Control System

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Stored XSS. This issue affects Access Control System (GKS): before Version 2.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Armiya
Products
Access Control System (gks)
CVE-2026-8309

Reflected XSS in Armiya Technologies' Access Control System

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Reflected XSS. This issue affects Access Control System (GKS): before Version 2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Armiya
Products
Access Control System (gks)
CVE-2026-8377

Improper Authorization in Armiya Technologies' Access Control System

Missing Authorization vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Collect Data from Common Resource Locations. This issue affects Access Control System (GKS): before Version 2.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Armiya
Products
Access Control System (gks)
CVE-2026-13199

Insufficient Entropy in Raspberry Pi 5 and Compute Module 5

EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resulted in consistent kernel addresses across boots and devices, potentially making it easier to exploit other vulnerabilities. Additionally, the low-quality RNG seed may affect the quality of random numbers or delay booting while sufficient entropy is accumulated from other sources.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Raspberrypi
Products
Raspberry Pi 5 And Compute Module 5
CVE-2026-33264

Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()

A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist.

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Apache
Products
Airflow
CVE-2026-11340

Authorization Bypass in HAVELSAN's Open Source Project Liman MYS

Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Liman MYS: before release.Master.1107.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Havelsan
Products
Liman Mys
CVE-2026-11348

Authentication Bypass in HAVELSAN's Open Source Project Liman MYS

Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data. This issue affects Liman MYS: before release.Master.1107.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Havelsan
Products
Liman Mys
CVE-2026-13696

LDAP Injection in HAVELSAN's Liman MYS

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in HAVELSAN Inc. Liman MYS allows LDAP Injection. This issue affects Liman MYS: before release.Master.1107.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Havelsan
Products
Liman Mys
CVE-2011-10043

Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded

Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed to load could use that bug to execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Bingos
Products
Module::load
CVE-2026-6101

AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwp_save_local_font() function combined with inadequate cleanup that fails to remove nested directories and files. This makes it possible for authenticated attackers, with Author-level access and above, and permissions granted by an Administrator, to write arbitrary files to the server in a web-accessible location, potentially leading to remote code execution on hosts that execute PHP files in the uploads directory.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Mohammed Kaludi Wordpress
Products
Amp For Wp – Accelerated Mobile Pages Wordpress
CVE-2026-12948

Stored Cross-Site Scripting (XSS)

A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages (CWE-79).

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Digi International
Products
Digi One Ia Digi One Sp Digi One Sp Ia and 1 more
CVE-2026-48954

Joomla! Core - [20260708] - XSS through language overrides

Improper validation leads to a generic XSS vector in the language override feature.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48949

Joomla! Core - [20260703] - XSS in MFA method management

Lack of validation leads to an XSS vulnerability in the MFA management views.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48948

Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download

An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48953

Joomla! Core - [20260707] - XSS in the generic image output layout

Lack of escaping leads to an XSS vulnerability in the generic image output layout.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48951

Joomla! Core - [20260705] - XSS in various modalreturn layouts

Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!