Search vulnerabilities

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,850

CVE-2026-57429

WordPress Slim SEO plugin <= 4.6.2 - Broken Access Control vulnerability

Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elightup Wordpress
Products
Slim Seo Wordpress
CVE-2026-54836

WordPress Filter & Grids plugin <= 3.11.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5.

CVSS 3.1 · 9.3 Critical EPSS 1.3% KEV · Not listed
Vendors
Wordpress Ymc
Products
Wordpress Ymc Filter
CVE-2026-2815

Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys

Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Silicon Labs
Products
Sisdk
CVE-2026-4526

Global ZCL command parser missing minimum-length validation in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-56122

Winstone Servlet Engine 0.9.10 Path Traversal via HTTP Request Paths

Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by sending HTTP GET requests with dot-dot-slash sequences that are not sanitized when serving static files from the configured webroot. Attackers can traverse outside the webroot directory using traversal-prefixed paths in a single HTTP request to read any file accessible to the servlet engine process, including sensitive system files when the service runs with elevated privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Rickknowles
Products
Winstone Servlet Container
CVE-2026-47145

Color Control hue/saturation assertion abort in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-47146

Color Control color-temperature assertion abort in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-47147

OTA server raw parser missing per-field bounds validation in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come from a device that has already joined the network. Only devices supporting the OTA Server cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-47148

Groups GetGroupMembership count/list-length mismatch in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Groups cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-47149

Door Lock GetUserType invalid table index in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Door Lock cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-47150

IAS Zone enroll invalid table index and write in EmberZNet 9.0.2

In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and location of this write is limited. These messages must come from a device that has already joined the network. Only devices supporting the IAS Zone cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-47151

Door Lock ClearWeekdaySchedule invalid table index and write in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location of this data is limited. These messages must come from a device that has already joined the network. Only devices supporting the Door Lock cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-47152

Level Control Move divide-by-zero in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-47153

Level Control Step With On/Off divide-by-zero in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-47154

Simple Metering GetProfileResponse interval-bounds bug in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Simple Metering cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-13314

Stored XSS in pretix-digital

Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Pretix-digital
CVE-2026-13223

Insufficient validation of payment status in pretix-computop

Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Pretix-computop