Search vulnerabilities

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-49872

Apache APISIX: Improper authentication in cas-auth plugin

Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credentials from a different source. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-11942

Akaunting 3.1.21 - Stored XSS in delete confirmation modal

Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create or modify records, such as Items, can store HTML/JavaScript in the record name.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Akaunting
Products
Akaunting
CVE-2026-11943

Akaunting 3.1.21 - Authenticated stored XSS in document timeline

Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authenticated user can store HTML/JavaScript in their own profile name.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Akaunting
Products
Akaunting
CVE-2026-8074

Improper Permission Check Allows User Manager to Deactivate Bot Accounts

Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/{id}/active API endpoint.. Mattermost Advisory ID: MMSA-2026-00667

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-41950

Dify < 1.14.0 Authorization Bypass via File UUID

Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file UUID in the files array of a chat-messages request. Attackers can exploit insufficient permission verification in the chat-messages endpoints to access files without ownership validation, bypassing workspace separation and signed URL protections to retrieve sensitive file contents through workflow processing.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Langgenius
Products
Dify
CVE-2026-49871

Apache APISIX: cas-auth login CSRF / session injection issue

Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send a victim to a webpage controlled by them can cause the victim's browser to become authenticated as a different identity. Actions the victim takes upstream are then attributed to attackers identity. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apisix Apache Apisix
CVE-2026-48895

Apache APISIX: Cas-auth Host header influence on CAS service URL

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-49231

Apache APISIX: Identity spoofing issue in APISIX opa plugin

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin. This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX: from 3.5.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-49230

Apache APISIX: Authentication bypass in jwe-decrypt

Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerable to authentication bypass.  This issue affects Apache APISIX: from 3.8.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-44087

Apache APISIX: Openid-connect plugin Identity Header Spoofing

Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an attack surface that allows the attacker to spoof identity headers allowing the attacker to get unauthorized access the protected resources. This issue affects Apache APISIX: from 2.3 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-47339

Apache APISIX: authz-casdoor incorrect session sharing

Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themselves with credentials from a different source. This issue affects Apache APISIX: from 2.14.1 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-12809

Edimax BR-6478AC V2 POST Request wiz_5in1_redirect command injection

A vulnerability was identified in Edimax BR-6478AC V2 1.23. Affected is the function wiz_5in1_redirect of the file /goform/wiz_5in1_redirect of the component POST Request Handler. Such manipulation of the argument newpass leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Edimax
Products
Br-6478ac V2
CVE-2026-44046

Apache APISIX: wolf-rbac plugin Identity Spoofing

Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute logs with spoofed identity information and exploit IP based access control rules. This issue affects Apache APISIX: from 1.2.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-39999

Apache APISIX: JWT Algorithm Confusion allows authentication bypass

Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication capitalising on certain configurations of jwt-auth plugin. This issue affects Apache APISIX: from v2.2 through v3.16.0. Users are recommended to upgrade to version v3.17.0, which fixes the issue.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apache Apisix Apisix
CVE-2026-12799

BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization

A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Berriai Litellm
Products
Litellm Litellm
CVE-2026-44915

Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default configuration of cas-auth in Apache APISIX is vulnerable to phishing and credential theft. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2026-39998

Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup

Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity headers. This issue affects Apache APISIX: from 2.12.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apache Apisix Apisix
CVE-2026-56448

Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e46baff2731d8f. An authenticated AIL user can supply crafted object identifiers through the investigation workflow to cause file paths to resolve outside the intended image, favicon, or screenshot storage directories. This may allow the attacker to download and read arbitrary files that are accessible to the AIL process. The issue occurs because user-controlled path components were joined with application storage paths without verifying that the resolved path remained within the expected directory. The affected download functionality could then include the contents of such files in a generated archive.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Ail-project
Products
Ail-framework
CVE-2026-9162

Global session revocation does not invalidate active WebSocket connections

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revocation, which allows a user with an existing WebSocket connection to remain authenticated and continue receiving real-time events until the cached session expires or the client reconnects.. Mattermost Advisory ID: MMSA-2026-00664

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-48137

Untrusted pointer dereference in NI grpc-device sideband streaming API

There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an attacker to cause an arbitrary memory dereference, potentially resulting in remote code execution.  Successful exploitation requires an attacker  to supply a specially crafted Moniker protobuf message.  This affects NI grpc-device 2.17.0 and prior versions.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Ni
Products
Grpc-device Instrumentstudio Ni Grpc Device Server