Search vulnerabilities

Expected end of text, found 'öhme' (at char 15), (line:1, col:16)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,932

CVE-2026-5265

Ovn: ovn: heap over-read in icmp error response generation

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Fast Datapath
CVE-2026-12205

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical "r". Keys used to sign more than once with an affected version should be considered compromised.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Timlegge
Products
Crypt::dsa
CVE-2026-12304

Same-origin policy bypass in the Networking: Cookies component

Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-12311

Information disclosure, sandbox escape in the Security: Process Sandboxing component

Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-12315

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-12316

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-12320

Information disclosure in the Password Manager component

Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-12323

Spoofing issue in the DOM: Core & HTML component

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-12324

Incorrect boundary conditions in the Graphics: CanvasWebGL component

Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-12329

Memory safety bug fixed in Thunderbird ESR 140.12

Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-12330

Incorrect boundary conditions in the Internationalization component

Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2024-22451

Uncontrolled Search Path Element in Dell Peripheral Manager Enables Arbitrary Code Execution

Dell Peripheral Manager, versions from 1.5.1 to 1.7.2, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious executable, leading to arbitrary code execution.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Peripheral Manager
CVE-2024-30476

Stored XSS in Dell PowerStore Manager

PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A remote authenticated low-privileged malicious actor could potentially exploit this vulnerability, it could lead to script execution in the client browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerstore
CVE-2026-53841

OpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTML

OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attackers can execute browser-side scripts if a trusted operator opens the exported file and activates a malicious link.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-53848

OpenClaw < 2026.5.26 - Exec Allowlist Bypass via Transparent Command Wrappers

OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowlisted command intent. Attackers can craft command requests that bypass allowlist validation by leveraging transparent command wrappers to perform unintended operations.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-11890

Authenticated Disclosure of PAM Account Discovery Results

Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Devolutions
Products
Devolutions Server
CVE-2026-22313

OS Commands Executed with Administrative Permissions in Radiflow iSAP Smart Collector

The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with administrative permissions by the underlying operating system.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Radiflow
Products
Isap Smart Collector
CVE-2026-0140

Out-of-Bounds Read in RtpPacket::decodePacket Resulting in Remote Information Disclosure in Android

In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-0162

AudioSdpParser ParsePayloads Type Confusion Leading to Remote Code Execution

In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-35269

Unauthenticated REST API Vulnerability in Oracle Identity Manager Allows Modification of Critical Data

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Identity Manager accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Identity Manager