Search vulnerabilities

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-54696

Ruby JSON: JSON generator heap buffer overflow when streaming to an IO

Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Ruby
Products
Json
CVE-2025-71352

picklescan - Remote Code Execution via Undetected trace.Trace.runctx in Pickle Files

picklescan before 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used in pickle file reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with trace.Trace.runctx payloads that bypass picklescan detection and execute code upon pickle.load() invocation.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Mmaitre314 Picklescan
Products
Picklescan Picklescan
CVE-2026-56327

Capgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPC

Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function that allows unauthenticated attackers to enumerate organization existence by observing distinct error responses. Attackers can call the SECURITY DEFINER function with a publishable API key to determine if an organization ID exists based on NO_ORG versus NO_RIGHTS responses, enabling tenant enumeration attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Cap-go
Products
Cap-go
CVE-2026-56249

Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.create_channel permission can exploit a logic mismatch between existence validation and upsert operations to reassign channel ownership and modify critical production channel configurations.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Cap-go
Products
Cap-go
CVE-2026-56318

Capgo - Information Disclosure via /private/validate_password_compliance Endpoint

Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validate_password_compliance endpoint that returns different error responses for malformed, non-existent, and existing organization IDs. Unauthenticated attackers can enumerate valid organization UUIDs by observing response status codes and error messages, allowing confirmation of organization existence.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Cap-go
Products
Cap-go
CVE-2026-56334

Capgo - Missing UPDATE RLS Policy for Build Status Persistence

Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving build_requests rows stuck in pending state with null last_error values.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cap-go
Products
Cap-go
CVE-2026-56365

ImageMagick - Memory Leak in PNG Encoder via MNG Image Writing

ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-57995

phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a group they belong to, inheriting those rights and escalating privileges up to full administrative control.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq
Products
Phpmyfaq
CVE-2026-56277

Flowise - Hardcoded CORS Wildcard in TTS Endpoint

Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its text-to-speech (TTS) generation endpoint (packages/server/src/controllers/text-to-speech/index.ts), independent of the server's configured CORS policy. This bypasses the server's otherwise restrictive default CORS configuration (getCorsOptions()) and allows any webpage to make cross-origin requests that trigger TTS generation using stored credentials, enabling drive-by cross-origin credential abuse.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Flowiseai
Products
Flowise
CVE-2026-56224

Capgo - Login CSRF and Session Fixation via URL Query Parameters

Capgo console.capgo.app/login before 12.128.2 accepts access_token and refresh_token in URL query parameters, automatically authenticating users without confirmation. Attackers can craft malicious links to force victims into attacker-controlled sessions, exposing tokens in browser history and logs.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Cap-go
Products
Cap-go
CVE-2026-12579

AS228T - Authentication Bypass Vulnerability

AS228T with Authentication Bypass Vulnerability

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-12575

DVP80ES3 Improper Resource Shutdown or Release Vulnerability

DVP80ES3 with  Improper Resource Shutdown or Release vulnerability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Deltaww
Products
Dvp80es3
CVE-2026-12576

DVP80ES3 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability

DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Deltaww
Products
Dvp80es3
CVE-2026-58449

txtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function Parameter

txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body parameter is resolved through txtai.util.Resolver, which performs __import__ and getattr on the caller-supplied dotted path with no allowlist. When the API is exposed with no TOKEN configured (authentication is opt-in, so all endpoints are unauthenticated) and the index is configured writable, a remote attacker can set function to an arbitrary callable such as subprocess.getoutput, achieving remote code execution as the server process during reindexing. Exploitation requires those deployment conditions (API exposed, no TOKEN, writable index); it is not the default configuration. The fix gates the endpoint behind a new reindex configuration flag.

CVSS 4.0 · 9.3 Critical EPSS 1.4% KEV · Not listed
Vendors
Neuml
Products
Txtai
CVE-2025-36320

Vulnerabilities found in Watson Data Intelligence

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Software Hub Watsonx.data Intelligence Watsonxdata Intelligence
CVE-2026-11595

IBM WebSphere Application Server is affected by a Path Traversal vulnerability

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server
CVE-2026-12084

IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains

IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Devops Deploy Ucd Ibm Devops Deploy
CVE-2026-12577

DVP80ES3 Improperly Implemented Security Check for Standard vulnerability

DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Deltaww
Products
Dvp80es3
CVE-2026-58519

Stored XSS through Cargo's map format

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. This issue affects Mediawiki - Cargo Extension: from * before 3.9.1.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Cargo