Search vulnerabilities

Expected end of text, found '–' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,805

CVE-2026-54036

LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET /api/auth/2fa/enable endpoint can be called by an authenticated user (or attacker with a stolen session) even when 2FA is already fully enabled on the account. This endpoint overwrites the existing TOTP secret, generates new backup codes, and sets twoFactorEnabled to false — all without requiring any TOTP or backup code verification. An attacker with a valid session token can completely take over a victim's 2FA, locking the legitimate user out of their own two-factor authentication. This vulnerability is fixed in 0.8.4-rc1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Danny-avila Librechat
Products
Libre Chat Librechat
CVE-2026-54158

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell renderer genAVValueHTML interpolates cell content raw in four of its branches: text, url, phone, and mAsset. A cell value like </textarea><img src=x onerror="..."> or "><img src=x onerror="..."> breaks out of its surrounding tag and runs arbitrary JavaScript in the renderer when the victim opens the block-attribute panel. On Electron desktop the renderer runs with nodeIntegration:true, so the XSS chains to host RCE via require('child_process'). AV files live under the workspace and ride normal sync, so an attacker with write access to any synced workspace plants the payload once and it fires on every device that opens a panel containing that row.he kernel doesn't escape on the way in either, so the malicious cell persists byte-for-byte. There's no equivalent of the html.EscapeAttrVal call that protects block IAL attributes at kernel/model/blockial.go:261. This vulnerability is fixed in 3.7.0.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Siyuan
Products
Siyuan
CVE-2026-55759

Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replay

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, Rocket.Chat's Apple Sign-In handler verifies JWT signatures but skips claims validation. Any Apple-signed JWT with a non-empty iss is accepted regardless of aud, exp, nbf, or nonce. An attacker who obtains a target user's Apple identity token (from server logs, an intercepted sign-in flow, or another application sharing the same Apple developer team) can replay it to authenticate as that user, with no expiration on the replay window. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Rocketchat
Products
Rocket.chat
CVE-2026-52812

Gogs: LFS dedupe path leaks private repo content across tenants

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git LFS storage is content-addressed by OID alone (<LFS-root>/<oid[0]>/<oid[1]>/<oid>) but per-repo authorization lives in the lfs_object table keyed (repo_id, oid). serveUpload skips re-uploading when the OID file already exists on disk and inserts a new (repo_id, oid) row pointing at it without verifying the request body hashes to the OID being claimed. Any user with write access to one repo can bind their repo to an OID owned by a private repo and download the original bytes via their own download endpoint. This vulnerability is fixed in 0.14.3.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Gogs
Products
Gogs
CVE-2026-31978

motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint

motionEye (mEye) is an online interface for motion software, which is a video surveillance program with motion detection. Versions prior to 0.44.0 are vulnerable to path traversal in the picture and movie API endpoints, suhc as /picture/{id}/preview/{filename}. Neither the API handlers, nor the mediafiles.py functions such as get_media_preview() check for .. sequences in the filename parameter, except for get_media_content(). This allows an authenticated user with normal (non-admin) privileges to read arbitrary files from the filesystem as the motionEye process user, such as: /etc/passwd, /etc/shadow, motionEye config files containing password hashes and plaintext passwords, SSH keys, and other cameras' surveillance footage. This issue has been fixed in version 0.44.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Motioneye Project
Products
Motioneye
CVE-2026-56054

WordPress JS Help Desk plugin <= 3.1.1 - Arbitrary File Deletion vulnerability

Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ahmad Wordpress
Products
Js Help Desk Wordpress
CVE-2026-41120

Remote Code Execution via Untrusted Data in Dell Wyse Management Suite

Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Wyse Management Suite
CVE-2026-46732

Race Condition in Dell Display and Peripheral Manager Enables Local Privilege Escalation

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain a Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Display And Peripheral Manager
CVE-2026-46734

Improper Certificate Validation in Dell Display and Peripheral Manager on macOS Enables Local Privilege Bypass

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Certificate Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Display And Peripheral Manager
CVE-2026-57587

SQL Injection in Nessus via Reverse DNS Lookup

A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inject malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Tenable
Products
Nessus
CVE-2026-57588

SQL Injection in Nessus via Malicious Scan Result File Import

A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.

CVSS 4.0 · 1.6 Low EPSS < 1% KEV · Not listed
Vendors
Tenable
Products
Nessus
CVE-2026-46735

Dell Display and Peripheral Manager OS Command Injection Vulnerability

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Display And Peripheral Manager
CVE-2026-13225

Stored XSS in ticket confirmation page

Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Pretix
CVE-2026-57535

Image URL Retrieval via PDF Content Injection Leaks Server Info and Enables SSRF

Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would download the image from that place and display it, thereby leaking information about the rendering server and possibly creating an SSRF vector in the local network.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Pretix
CVE-2026-57533

Phishing via Uncontrolled HTML Injection on Redirected Pages

Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Pretix
CVE-2026-40210

Out-of-bounds read in SetMacAddrAction

An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Powerdns
Products
Dnsdist
CVE-2026-42004

EDNS options smuggling

An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Powerdns
Products
Dnsdist
CVE-2026-52690

Spoofed answers can mark an authoritative non-EDNS capable

Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Powerdns
Products
Recursor