Search vulnerabilities

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,898

CVE-2022-49036

Local Code Execution via Untrusted OpenSSL Configuration in Synology Active Backup for Business Recovery Media Creator

An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Synology
Products
Active Backup For Business Recovery Media Creator Synology Active Backup For Business Recovery Media Creator
CVE-2026-10775

sgl-project SGLang Cache data_hash denial of service

A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is the function data_hash of the component Cache Handler. This manipulation causes denial of service. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Lmsys Sgl-project
Products
Sglang Sglang
CVE-2026-9211

Certain NETGEAR routers allow unauthenticated users to gain control of the router

An unauthenticated user on the local network can gain control of the router and make unauthorized changes to its operation.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Netgear
Products
Cax30 Cax30 Firmware Rax30 and 5 more
CVE-2026-9210

Certain NETGEAR routers allow authenticated administrators to gain unintended control of the router

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Netgear
Products
Ex3700 Ex3700 Firmware Ex3800 and 59 more
CVE-2026-46491

SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver builds file paths for the file-based CAS ticket store by directly concatenating the configured ticket directory with an attacker-controlled ticket identifier. Public CAS validation/proxy endpoints pass attacker-controlled ticket / pgt query parameters into this store. In deployments using FileSystemTicketStore, a remote attacker can use path traversal sequences such as ../target.serialized to make the CAS server read and unserialize files outside the ticket directory. In the CAS 1.0 validation flow, the same attacker-selected path is also passed to deleteTicket() immediately after getTicket() returns, which can delete the target file when it is readable by the PHP process, deletable under the PHP process filesystem permissions, and unserializes to a value compatible with the ?array return type. This issue has been patched in version 7.0.3.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Simplesamlphp
Products
Simplesamlphp-module-casserver
CVE-2026-3088

Unauthenticated users can disrupt router operation

Unauthenticated users on the local network can cause the router to become unavailable by sending specially crafted requests.

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Netgear
Products
Rbe970 Rbe970 Firmware Rbe971 and 15 more
CVE-2026-53673

BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user's private messages.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Buddypress Wordpress
Products
Buddypress Wordpress
CVE-2026-10783

gradio-app gradio Audio Cache Key save_audio_to_cache weak hash

A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Performing a manipulation results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The patch is named 13394. To fix this issue, it is recommended to deploy a patch.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Gradio-app Gradio Project
Products
Gradio Gradio
CVE-2026-11682

chromium-browser: Insufficient validation of untrusted input in Views

Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Google Linux
Products
Chrome Linux Kernel
CVE-2026-36719

AgentChat /api/v1/user/info Unauthenticated Information Disclosure Revealing Password Hashes

An information disclosure vulnerability in the /api/v1/user/info endpoint of AgentChat v2.3.0 allows unauthenticated attackers to obtain sensitive information, including SHA256 password hashes, via enumerating user IDs.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Agentchat
Products
Agentchat
CVE-2026-45591

ASP.NET Core Denial of Service Vulnerability

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Apple Linux Microsoft and 1 more
Products
Macos Linux Kernel .net and 5 more
CVE-2026-45491

.NET Tampering Vulnerability

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Linux Microsoft and 1 more
Products
Macos Linux Kernel .net and 3 more
CVE-2026-45490

.NET SDK Elevation of Privilege Vulnerability

Improper authorization in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
.net Windows
CVE-2026-10804

Streamlit Palette hashing.py weak hash

A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Snowflake Streamlit
Products
Streamlit Streamlit
CVE-2026-53698

Silverpeas Personal Space Path Traversal Vulnerability

Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Silverpeas
Products
Silverpeas
CVE-2026-41727

In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence. Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring For Apache Kafka Spring For Apache Kafka
CVE-2026-10814

milvus-io milvus Grantee ID Hash kv_catalog.go weak hash

A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rootcoord/kv_catalog.go of the component Grantee ID Hash Handler. The manipulation leads to use of weak hash. The attack needs to be performed locally. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 3d932f1c3e065351c4440c27abe1e6479752544d. Applying a patch is the recommended action to fix this issue.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Milvus Milvus-io
Products
Milvus Milvus
CVE-2026-41728

Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections

Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Data Rest Spring Data Rest