Search vulnerabilities

Expected end of text, found ':' (at char 23), (line:1, col:24)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,601

CVE-2025-59601

Exposure of Sensitive Information Through Metadata in Powerline Communication Firmware

Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qualcomm
Products
Fastconnect 7800 Fastconnect 7800 Firmware Qca7005 and 14 more
CVE-2025-59604

NULL Pointer Dereference in SPS Applications

Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Qualcomm
Products
Ar8035 Ar8035 Firmware Cologne and 528 more
CVE-2026-39831

Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh

The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Golang
Products
Crypto Ssh
CVE-2026-44660

UltraJSON: Memory Leak in ujson.dump() on Write Failure

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Ultrajson Ultrajson Project
Products
Ultrajson Ultrajson
CVE-2026-39976

Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens

Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user. This vulnerability is fixed in 13.7.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Laravel
Products
Passport
CVE-2026-45136

claude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.sh

claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of the payload closes the literal early and lets following bytes execute as Python in the user's Claude Code process. This vulnerability is fixed in 3.5.2.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Cnighswonger
Products
Claude-code-cache-fix
CVE-2026-44709

pam_usb: PINENTRY_FALLBACK_APP environment variable allows arbitrary command execution

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, pamusb-pinentry reads the PINENTRY_FALLBACK_APP environment variable and executes it directly without any validation. Any process that can set environment variables before pamusb-pinentry is invoked can point PINENTRY_FALLBACK_APP at an arbitrary binary or script and have it executed with the privileges of the pam_usb tool chain. This vulnerability is fixed in 0.8.7.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Mcdope
Products
Pam Usb
CVE-2026-4837

Eval Injection in Rapid7 Insight Agent

An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code execution as root via a crafted beacon response. Because the Agent uses mutual TLS (mTLS) to verify commands from the Rapid7 Platform, it is unlikely that the eval() function could be exploited remotely without prior, highly privileged access to the backend platform.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Rapid7
Products
Insight Agent
CVE-2026-35023

Wimi Teamwork On-Premises < 8.2.0 IDOR via preview.php

Wimi Teamwork On-Premises versions prior to 8.2.0 contain an insecure direct object reference vulnerability in the preview.php endpoint where the item_id parameter lacks proper authorization checks. Attackers can enumerate sequential item_id values to access and retrieve image previews from other users' private or group conversations, resulting in unauthorized disclosure of sensitive information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cloud Solutions Wimi-teamwork
Products
Wimi Teamwork Wimi-teamwork
CVE-2026-28264

Information Exposure via Improper Permission Assignment in Dell PowerProtect Agent Service

Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerprotect Agent Powerprotect Data Manager
CVE-2026-28373

Stackfield Desktop App Path Traversal Leading to Arbitrary File Write

The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality when processing the filePath property. A malicious export can write arbitrary content to any path on the victim's filesystem.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Apple Microsoft Stackfield
Products
Macos Windows Desktop App and 1 more
CVE-2026-41213

@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force code_verifier guesses online until token issuance succeeds.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Node-oauth
Products
Node-oauth2-server Node-oauth\/oauth2-server
CVE-2026-48064

pam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypass

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is configured with deny_remote=false in pam_usb (commonly done for display managers such as gdm-password or lightdm to bypass process/TTY heuristics for local sessions), the PAM_RHOST check in pusb_do_auth() is also skipped. PAM_RHOST is set by remote daemons (sshd, XDMCP servers) to identify the remote client address. Because the check is gated inside if (opts.deny_remote), a genuine remote XDMCP connection reaches the USB device authentication step instead of being rejected. This vulnerability is fixed in 0.9.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Mcdope
Products
Pam Usb
CVE-2026-34460

NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping

NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause a victim's browser to navigate to it, resulting in the victim's session being authenticated as the attacker-linked account (OAuth login CSRF / session swapping). This is patched in version 2.2.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Namelessmc
Products
Nameless
CVE-2022-4986

Hirschmann EagleSDV Denial of Service via TLS

Hirschmann EagleSDV version 05.4.01 prior to 05.4.02 contains a denial-of-service vulnerability that causes the device to crash during session establishment when using TLS 1.0 or TLS 1.1. Attackers can trigger a crash by initiating TLS connections with these protocol versions to disrupt service availability.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Beldan Belden
Products
Eaglesdv Eaglesdv Firmware Hirschmann Eaglesdv
CVE-2026-10606

DedeCMS Feedback feedback.php TrimMsg sql injection

A vulnerability was determined in DedeCMS 5.7.88. The affected element is the function TrimMsg of the file /plus/feedback.php of the component Feedback Handler. Executing a manipulation of the argument msg can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Dedecms
Products
Dedecms
CVE-2026-25204

Denial of Service via Untrusted Data Deserialization in Samsung Escargot

Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process abort. This issue affects escarogt prior to commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Samsung Samsung Open Source
Products
Escargot Escargot