Search vulnerabilities

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,775

CVE-2025-9912

A local privilege escalation vulnerability in Nokia SR Linux

Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privilege.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nokia
Products
Nokia Sr Linux
CVE-2026-8444

WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'curselrevs' Parameter

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselrevs'] raw with no sanitization or type casting, then concatenating each array element directly into a `WHERE id IN ( ... )` clause without quoting and executing via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpreviewslider
Products
Wordpress Wp Review Slider Pro
CVE-2026-10093

File Sharing & Download Manager <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'fldr_ttl' Parameter

The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldr_ttl' parameter in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Deepakkite Wordpress
Products
Secure Client Portal And Private File Sharing Plugin – User Private Files Wordpress
CVE-2026-5416

Command Injection via name parameter

Due to the improper neutralization of special elements used in a name parameter a low privileged remote attacker can exploit a command injection vulnerability in the Managed Ethernet Switch, resulting in full system compromise.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Turck
Products
Tben-l4-se-m2 Tben-l5-se-m2 Tben-ll-se-m2
CVE-2026-54197

WordPress GetGenie plugin <= 4.4.1 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpmet
Products
Wordpress Getgenie
CVE-2026-49774

WordPress RD Station plugin <= 5.6.0 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Filipe Nasc Wordpress
Products
Rd Station Wordpress
CVE-2026-40809

WordPress Metro Magazine theme <= 1.4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Rara Themes Wordpress
Products
Metro Magazine Wordpress
CVE-2026-8442

WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter

The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authorization checks on the wpfb_hide_review and wprp_save_review_admin AJAX handlers combined with insufficient path validation in the wpfb_hidereview_ajax() function, which uses strpos() to check that a stored media URL starts with the expected prefix but fails to sanitize path traversal sequences in the remaining relative path before passing it to unlink(). This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpreviewslider
Products
Wordpress Wp Review Slider Pro
CVE-2026-8484

Heap buffer overflow in Jansi

A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl()" wrapper due to a lack of size verification for the argument array before the system call. This can lead to heap corruption and application crashes (DoS). All versions are believed to be vulnerable. This project is unmaintained at the time of CVE assignment.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Fusesource
Products
Jansi
CVE-2026-40750

WordPress Kids Online Store theme <= 0.8.9 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server. This issue affects Kids Online Store: from n/a through 0.8.9.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Themagnifico52 Wordpress
Products
Kids Online Store Wordpress
CVE-2026-12225

syracom Secure Login (2FA) for Confluence allows 2FA bypass via spoofed User-Agent

syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vulnerability. An attacker with valid credentials for a user account can bypass the two-factor authentication flow by sending HTTP requests with a crafted User-Agent header containing specific strings such as AtlassianMobileApp or JIRA. When such a User-Agent is present, the plugin does not enforce the configured 2FA checks for protected web resources. Successful exploitation allows the attacker to access the affected Atlassian application as the compromised user without completing 2FA. If the compromised account has administrative privileges, the attacker can access administrative functionality and may disable the 2FA plugin or make arbitrary administrative changes. The issue is fixed in version 3.5.0.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Syracom
Products
Secure Login (2fa) For Bitbucket Secure Login (2fa) For Confluence Secure Login (2fa) For Jira
CVE-2026-42089

yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation and code execution during CLI bootstrap. The vulnerable method is installLocalGenerators(), which calls repository.install() directly without prompting the user. This issue has been fixed in version 6.0.0.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Yeoman
Products
Environment
CVE-2026-47748

stable-diffusion.cpp: Out-of-bounds reads in PyTorch checkpoint pickle opcode parsing

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior to master-584-0a7ae07 are vulnerable to an out-of-bounds reads error through PyTorch checkpoint pickle opcode parsing. The pickle .ckpt parser in src/model.cpp did not consistently check that enough input remained before reading opcode arguments or advancing the parser buffer with a crafted or truncated .ckpt file. Throughout the pickle parser, opcode handlers advanced the parser position with expressions such as buffer += N without first checking that buffer + N <= buffer_end. A truncated file could therefore cause reads past the end of the metadata buffer. LibFuzzer found crashes in under one second using malformed checkpoint inputs. Any application using affected stable-diffusion.cpp releases to load untrusted .ckpt model files could be vulnerable. The attack requires the victim or application to load a .ckpt file from an untrusted source, such as a downloaded model from a model sharing site. This issue has been fixed in version master-584-0a7ae07. If developers are unable to immediately update their applications, they can work around this issue by ensuring they do not load .ckpt checkpoint files from untrusted sources. They should prefer trusted model sources and safer formats such as .safetensors where possible.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Leejet
Products
Stable-diffusion.cpp
CVE-2024-39575

Plain Text Password Exposure in VxRail Disk PSU Baseline Script

update_disk_psu_baseline.sh requires password in plain text

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Dell Emc Vxrail Appliance