Search vulnerabilities

Expected end of text, found ':' (at char 31), (line:1, col:32)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,461

CVE-2021-31942

3D Viewer Remote Code Execution Vulnerability

3D Viewer Remote Code Execution Vulnerability

CVSS 3.1 · 7.8 High EPSS 2.2% KEV · Not listed
Vendors
Microsoft
Products
3d Viewer
CVE-2026-48901

Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects

The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-45021

Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Kumahq
Products
Kuma
CVE-2026-45306

pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, but does NOT protect the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker can set storage_folder to the session directory and download session files of other users via /files/get/, leading to account takeover. This vulnerability is fixed in 0.5.0b3.dev100.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pyload
Products
Pyload
CVE-2026-46561

pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the PREREQFUNCTION-based private IP check was not applied to HTTPRequest (used by the parse_urls API). An authenticated attacker can supply a URL pointing to an attacker-controlled server that responds with a 302 redirect to an internal/private IP address, bypassing the is_global_host() check on the initial URL. This vulnerability is fixed in 0.5.0b3.dev100.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Pyload
Products
Pyload
CVE-2026-45348

pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via $(div).html(html). No escaping runs between the API value and innerHTML. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator's browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers. This vulnerability is fixed in 0.5.0b3.dev100.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Pyload
Products
Pyload
CVE-2026-42082

free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 §6.9.5.1. The AMF does not check for ongoing N2 handover procedures before initiating a NAS Security Mode Command, and vice versa. This can lead to mismatches between NAS and AS security contexts in the network and the UE. This vulnerability is fixed in 4.2.2.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Free5gc
Products
Free5gc
CVE-2026-47761

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tiny Tinymce
Products
Tinymce Tinymce
CVE-2026-47762

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tiny Tinymce
Products
Tinymce Tinymce
CVE-2019-19378

kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image can lead to slab-out-of-bounds write access in index_rbio_pages in fs/btrfs/raid56.c.

CVSS 3.1 · 7.8 High EPSS 2.3% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2019-18197

libxslt: use after free in xsltCopyText in transform.c could lead to information disclosure

In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 3 more
CVE-2019-17571

log4j: deserialization of untrusted data in SocketServer

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

CVSS 3.1 · 9.8 Critical EPSS 70.0% KEV · Not listed
Vendors
Apache Canonical Debian and 4 more
Products
Bookkeeper Log4j Ubuntu Linux and 23 more
CVE-2019-16230

kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c

drivers/gpu/drm/radeon/radeon_display.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. NOTE: A third-party software maintainer states that the work queue allocation is happening during device initialization, which for a graphics card occurs during boot. It is not attacker controllable and OOM at that time is highly unlikely

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2019-13721

chromium-browser: use-after-free in PDFium

Use after free in PDFium in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras