Search vulnerabilities

Expected end of text, found ':' (at char 23), (line:1, col:24)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,120

CVE-2026-25109

Copeland XWEB and XWEB Pro OS Command Injection

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field when accessing the get setup route.

CVSS 3.1 · 8 High EPSS 1.7% KEV · Not listed
Vendors
Copeland
Products
Copeland Xweb 300d Pro Copeland Xweb 500b Pro Copeland Xweb 500d Pro and 6 more
CVE-2026-6074

Path traversal: '.../...//' in Intrado 911 Emergency Gateway (EGW)

Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the download_debuglog_file.php endpoint used for Debug Logs downloads. An unauthenticated attacker can manipulate the name parameter to read arbitrary files outside the intended directory.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Intrado
Products
911 Emergency Gateway
CVE-2026-7251

Eppendorf BioFlo 320 Use of hard-coded password

Eppendorf BioFlo 320 is vulnerable due to VNC server using a hard-coded password. If a remote attacker knows the network address of any BioFlo 320 model with remote access enabled, they can gain full control of the user interface by using this password. Once connected, the attacker would have full access to all control panel features for the BioFlo 320. VNC traffic is not encrypted.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Eppendorf
Products
Bioflo 320
CVE-2017-6034

Schneider Electric Modicon Modbus Protocol Authentication Bypass by Capture-replay

An authentication bypass by capture-replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the following commands: run, stop, upload, and download.

CVSS 3.1 · 9.8 Critical EPSS 5.6% KEV · Not listed
Vendors
Schneider-electric
Products
Modbus Modbus Firmware
CVE-2026-4035

Environment Variable Resolution Vulnerability in mlflow/mlflow

A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the `api_key` field in gateway secrets can accept `$ENV_VAR` references, which are resolved against the MLflow server's environment during runtime. The resolved secrets are then sent in provider authentication headers to the configured upstream `api_base`. This vulnerability can be exploited by low-privileged authenticated users in basic-auth deployments or by unauthenticated users in default deployments without `basic-auth`. The impact includes potential leakage of sensitive credentials such as cloud artifact credentials (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`), which could lead to artifact poisoning and cross-boundary code execution in downstream environments. The issue is fixed in version 3.11.0.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Lfprojects Mlflow
Products
Mlflow Mlflow/mlflow
CVE-2025-49848

Out-of-bounds Write in LS Electric GMWin 4

An out-of-bounds write vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which can result in different memory corruption issues within the application, such as reading and writing past the end of allocated data structures.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-53471

Emerson ValveLink Products Improper Input Validation

Emerson ValveLink products receive input or data, but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Emerson
Products
Valvelink
CVE-2025-66590

Out-of-bounds Write vulnerability in AzeoTech DAQFactory

In AzeoTech DAQFactory release 20.7 (Build 2555), an out-of-bounds write vulnerability can be exploited by an attacker to cause the program to write data past the end of an allocated memory buffer. This can lead to arbitrary code execution or a system crash.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Azeotech
Products
Daqfactory
CVE-2025-66588

Access of Uninitialized Pointer vulnerability in AzeoTech DAQFactory

In AzeoTech DAQFactory release 20.7 (Build 2555), an access of uninitialized pointer vulnerability can be exploited by an attacker which can lead to arbitrary code execution.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Azeotech
Products
Daqfactory
CVE-2026-10796

nvm executes commands from a malicious Node.js mirror's version strings

nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as `nvm install` read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs and shell/awk commands. Two sinks are affected by the same untrusted input: nvm_download() built a curl/wget command string and ran it with `eval`, so a version field containing command substitution (for example $(id)) was executed by the local shell; and nvm_get_checksum() interpolated the version-derived download slug into an awk program, so a crafted version could execute arbitrary commands via awk's system(). An attacker who controls the configured mirror, supplies mirror content to a user or CI on a non-default mirror, or machine-in-the-middles a non-TLS mirror can ∴ run arbitrary commands with the privileges of the user running nvm. The default mirror (https://nodejs.org over TLS) is not affected. Fixed on master (pending the next tagged release) by passing every argument as a literal argv element instead of using eval, by passing the value to awk as data via -v instead of interpolating it into the program, and by rejecting any version outside the Node.js/io.js version grammar before it is used.

CVSS 4.0 · 7.5 High EPSS 5.0% KEV · Not listed
Vendors
Nvm-sh Openjsf
Products
Nvm Node Version Manager
CVE-2025-66586

Type Confusion vulnerability in AzeoTech DAQFactory

In AzeoTech DAQFactory release 20.7 (Build 2555), an access of resource using incompatible type vulnerability can be exploited to cause memory corruption while parsing specially crafted .ctl files. This could allow an attacker to execute code in the context of the current process.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Azeotech
Products
Daqfactory
CVE-2025-14771

File Disclosure in ABB T-MAC Plus web application and in ABB T-MAC plus Server - Default IIS Web Site

Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Abb
Products
T-mac Plus
CVE-2025-14772

Broken Access Control in ABB T-MAC Plus web application

Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Abb
Products
T-mac Plus
CVE-2025-66585

Use After Free vulnerability in AzeoTech DAQFactory

In AzeoTech DAQFactory release 20.7 (Build 2555), a use after free vulnerability can be exploited to cause memory corruption while parsing specially crafted .ctl files. This could allow an attacker to execute code in the context of the current process.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Azeotech
Products
Daqfactory
CVE-2025-14773

Stored Cross-Site Scripting in ABB T-MAC Plus web application

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Abb
Products
T-mac Plus
CVE-2025-14774

Communication analysis between the Card Reader and TP2CardReaderService daemon

Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Abb
Products
T-mac Plus
CVE-2025-12659

Heap-based buffer overflow in Siemens Simcenter Femap

Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted IPT files. This could allow an attacker to execute code in the context of the current process.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Siemens
Products
Simcenter Femap
CVE-2026-49448

authentik: SourceStage bypass via empty POST

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Goauthentik
Products
Authentik
CVE-2026-49443

authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Goauthentik
Products
Authentik
CVE-2026-47201

authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Source ACS endpoint is vulnerable to XML Signature Wrapping when validating upstream SAML responses. An attacker with any account at the upstream IdP can reuse a valid signed assertion to authenticate as another federated user. This issue has been patched in versions 2025.12.5, 2026.2.3, and 2026.5.1.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Goauthentik
Products
Authentik