Search vulnerabilities

Expected end of text, found ':' (at char 22), (line:1, col:23)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,822

CVE-2026-14434

IBM Turbonomic kubeturbo agent used by IBM Turbonomic Application Resource Management is affected by vulnerability

IBM Turbonomic kubeturbo agent 8.16.0 through 8.21.2 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Turbonomic Kubeturbo Agent
CVE-2026-120386

Effect File Validation Flaw Causes Application Crash

Effekseer improperly validates "effect" files. When a crafted effect file is loaded to the affected runtime, the host process may be forced to crash.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Effekseer
Products
Effekseer
CVE-2026-109582

Insecure Storage of Sensitive Information in SS1 Exposes Confidential Data

Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd. Sensitive information used by the product may be obtained.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Dos-osaka
Products
Ss1
CVE-2026-113437

Arbitrary File Deletion via Path Traversal in SS1/SS1 Cloud and rocoeyes

Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS Co., Ltd. and the ODM product rocoeyes provided by Rococo Co. Ltd. Arbitrary files may be deleted.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Dos-osaka Rococo
Products
Ss1 Ss1 Cloud Rocoeyes
CVE-2026-123870

[Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string-injected webhook body when GITHUB_WEBHOOK_SECRET is unset

The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the webapp host.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed
Vendors
Eclipse Foundation
Products
Otterdog
CVE-2026-92683

Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphql

Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operator syntax.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Neo4j
Products
Graphql
CVE-2026-124621

kongxin-github Java_Library_Management_System Swing UI Layer MainInterface.java Landing.sureadmin improper authorization

A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Book.modifybook/Book.deletebook/Category.addcategory/Category.setcategory/Landing.sureadmin of the file src/view/MainInterface.java of the component Swing UI Layer. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Kongxin-github
Products
Java Library Management System
CVE-2026-112172

Unauthenticated SQL Execution in XDent/XMedical Synchronization Infrastructure

CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.

CVSS 4.0 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Xdent Xmedical
CVE-2026-118450

Venere loads replaceable unsigned components from a writable installation location

Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Venere
CVE-2026-118458

AIS shared test login provider contains fixed administrative credentials

The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.

CVSS 4.0 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Phronesis Venere
CVE-2026-118459

AIS PasswordSOS permits authentication without legitimate credentials

A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118460

AIS embedded private keys enable practitioner impersonation

Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.

CVSS 4.0 · 8 High EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118461

AIS PersonnelService client performs unauthenticated doctor-specific operations

The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.

CVSS 4.0 · 8 High EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118462

AIS update mechanism executes unverified code

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118464

AIS shared cryptographic services use fixed cryptographic secrets

Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118465

AIS products use vendor-wide hard-coded database credentials

Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118467

AIS products expose clinical and personal data via logs and telemetry

Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection.

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118468

AIS XML parsers allow external entity resolution

XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118790

Multiple Hardcoded Credentials

Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Wingesfar
CVE-2026-118791

Insecure software update mechanism

The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Wingesfar