Search vulnerabilities

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,852

CVE-2026-46735

Dell Display and Peripheral Manager OS Command Injection Vulnerability

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Display And Peripheral Manager
CVE-2026-13225

Stored XSS in ticket confirmation page

Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Pretix
CVE-2026-57535

Image URL Retrieval via PDF Content Injection Leaks Server Info and Enables SSRF

Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would download the image from that place and display it, thereby leaking information about the rendering server and possibly creating an SSRF vector in the local network.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Pretix
CVE-2026-57533

Phishing via Uncontrolled HTML Injection on Redirected Pages

Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Pretix
CVE-2026-40210

Out-of-bounds read in SetMacAddrAction

An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Powerdns
Products
Dnsdist
CVE-2026-42004

EDNS options smuggling

An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Powerdns
Products
Dnsdist
CVE-2026-52690

Spoofed answers can mark an authoritative non-EDNS capable

Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Powerdns
Products
Recursor
CVE-2026-54841

WordPress Vitepos plugin <= 3.4.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Appsbd Wordpress
Products
Vitepos Wordpress
CVE-2026-12755

Authenticated PAM AD Discovery Credential Exposure via NTLMv2 Challenge‑Response in Devolutions Server

Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Devolutions
Products
Devolutions Server Server
CVE-2026-42389

Reject more queries with invalid header values

This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Powerdns
Products
Recursor
CVE-2026-55477

Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). This vulnerability is fixed in 3.3.1.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Mhsanaei
Products
3x-ui
CVE-2025-64309

Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials

The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Brightpick Ai
Products
Mission Control
CVE-2025-64307

Brightpick Mission Control / Internal Logic Control Missing Authentication for Critical Function

The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit this interface to manipulate robot control functions, including initiating or halting runners, assigning jobs, clearing stations, and deploying storage totes.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Brightpick Ai
Products
Internal Logic Control
CVE-2025-64308

Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials

The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Brightpick Ai
Products
Mission Control
CVE-2026-57452

Vim: Out-of-bounds Read with libsodium-encrypted Files

Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Vim
Products
Hummingbird Vim
CVE-2026-57451

Vim: Out-of-bounds Read in Text Property Count

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2026-6094

Heap buffer overread in wc_PKCS7_DecodeEnvelopedData parsing crafted PKCS7 EnvelopedData

Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wolfssl
Products
Wolfssl
CVE-2026-6291

Bleichenbacher padding oracle in PKCS#7 KTRI RSA PKCS#1 v1.5 decryption

Bleichenbacher padding oracle in PKCS#7 KTRI decryption. When decrypting PKCS#7 EnvelopedData using RSA PKCS#1 v1.5 key transport, wolfSSL returned distinguishable error codes depending on whether RSA padding validation failed versus whether the decrypted content was malformed. An attacker able to submit crafted EnvelopedData messages and observe error responses could use this as a padding oracle to incrementally recover the encrypted Content Encryption Key (CEK). The fix generates a deterministic pseudo-random fake CEK on padding failure (via HMAC-SHA256) and proceeds with decryption identically, using constant-time operations throughout, so that all failure paths produce the same error regardless of padding validity.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Wolfssl
Products
Wolfssl
CVE-2026-40011

Prometheus denial of service via crafted DNS queries

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Powerdns
Products
Dnsdist