Search vulnerabilities

Expected end of text, found ':' (at char 25), (line:1, col:26)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,822

CVE-2025-62624

Heap-based Buffer Overflow in AMD Pensando DPU Ionic Cloud Driver Allowing Privilege Escalation

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Amd
Products
Esxi 8.x And Esxi 9.x Hosts Using Amd-pensando Dpu Products
CVE-2026-35227

Improper resource management in CODESYS Modbus TCP Server

An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully exploited, preventing legitimate clients from establishing new connections.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Codesys
Products
Codesys Codesys Modbus
CVE-2026-43916

pam_authnft: Heap buffer overflow in NETLINK_SOCK_DIAG reply walker

pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes. Prior to 0.2.0-alpha, a heap buffer over-read in peer_lookup_tcp (src/peer_lookup.c:134, prior to the fix) allowed a crafted NETLINK_SOCK_DIAG reply to slip past the message-size check, then dereference past the end of the allocation. This vulnerability is fixed in 0.2.0-alpha.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Identd-ng
Products
Pam Authnft
CVE-2026-42300

DevGuard: Unauthenticated identity assertion via `X-Admin-Token` header

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user's Kratos identity UUID can issue requests as that user. Where the target user is an organisation admin or owner, this gives the attacker full control over that organisation's DevGuard resources. This vulnerability is fixed in 1.2.2.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
L3montree-dev
Products
Devguard
CVE-2025-62623

Heap Overflow in VMware ESXi Ionic Cloud Driver Enables Privilege Escalation

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Amd
Products
Esxi 8.x And Esxi 9.x Hosts Using Amd-pensando Dpu Products
CVE-2026-43939

YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature accepts user-supplied content via a a post or reply that is stored server-side and later rendered back into the thread page without adequate HTML sanitization or contextual output encoding. This vulnerability is fixed in 4.0.5 and 3.2.12.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Yafnet
Products
Yafnet
CVE-2026-43992

JunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameter

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call parameter. The BIP-39 seed was consequently embedded in the LLM tool-call JSON, exposing it to any transport, log, or telemetry surface in the path between the LLM provider and the MCP process. This vulnerability is fixed in 0.x.y-security-1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Dragonmonk111
Products
Junoclaw
CVE-2026-41610

Visual Studio Code Security Feature Bypass Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Code
CVE-2025-62627

Untrusted Pointer Dereference in VMware ESXi Ionic Cloud Driver Enables Unprivileged VM Memory Leakage

An untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an attacker with an unprivileged VM to read kernel memory or co-located guest VM memory, potentially resulting in loss of confidentiality or availability.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Amd
Products
Esxi 8.x And Esxi 9.x Hosts Using Amd-pensando Dpu Products
CVE-2026-42177

linux-entra-sso: PRT SSO cookie can leak to attacker-controlled hosts when broad host permissions are granted

linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform/chrome/js/platform-chrome.js:69-88 registers a single declarativeNetRequest rule whose urlFilter is Platform.SSO_URL + "/*", i.e. "https://login.microsoftonline.com/*". Chrome's urlFilter without a | or || anchor is substring-matched against the full request URL. The same applied rule action is modifyHeaders that attaches the Entra ID Primary Refresh Token cookie. The Firefox adapter in platform/firefox/js/platform-firefox.js:53 performs a belt-and-braces startsWith(Platform.SSO_URL) check before injecting the header; the Chrome adapter does not. When the extension holds broad host permissions through the optional_host_permissions: ["https://*/*"] declared in platform/chrome/manifest.json:34, a main-frame navigation to a URL whose path embeds https://login.microsoftonline.com/ causes Chrome to attach the PRT cookie to the request to the attacker-controlled host. This vulnerability is fixed in 1.8.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Siemens
Products
Linux-entra-sso
CVE-2026-43929

ssrfcheck: Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs

ssrfcheck is a library that checks if a string contains a potential SSRF attack. In 1.3.0 and earlier, ssrfcheck fails to block Server-Side Request Forgery attacks when the target private IP address is encoded as an IPv4-mapped IPv6 address (e.g. http://[::ffff:127.0.0.1]/). The WHATWG URL parser built into Node.js silently normalizes the IPv4 notation inside the brackets to compressed hex form ([::ffff:7f00:1]) before the library's private-IP regex ever runs. The regex was written to match dot-notation only and therefore never matches any real input — all seven IANA private IPv4 ranges, including the AWS/GCP/Azure metadata address 169.254.169.254, are bypassed. Any application using isSSRFSafeURL() to guard HTTP requests made with user-supplied URLs is fully exposed to SSRF.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Felipperegazio
Products
Ssrf Check
CVE-2026-28922

macOS State Management Vulnerability Enables Unauthorized Data Access.

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to access private information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Macos
CVE-2026-30810

Server-Side Request Forgery in API Checker leads to Privilege Escalation

Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pandora FMS: from 777 through 800

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Artica Pandora Fms
Products
Pandora Fms Pandora Fms
CVE-2026-28941

Denial of Service and Potential Memory Disclosure via Malicious File Processing

The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Tahoe 26.5. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ios And Ipados Ipados Iphone Os and 1 more
CVE-2025-61972

NBIO Register Lock Bit Exposure Grants Local Administrator Arbitrary SMN Access

Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to gain arbitrary System Management Network (SMN) access, potentially resulting in arbitrary code execution in AMD Secure Processor (ASP) and loss of the SEV-SNP guest's confidentiality and integrity.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Amd
Products
Epyc 8004 Series Processors Epyc 9004 Series Processors Epyc 9005 Series Processors and 3 more
CVE-2026-28957

Unauthorized Screen Capture via App Access to Camera Metadata

An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to capture a user's screen.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ios And Ipados Ipados Iphone Os and 1 more
CVE-2026-28959

Buffer Overflow in Apple Operating Systems Causes Unexpected Termination

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ios And Ipados Ipados Iphone Os and 4 more
CVE-2026-6888

SQL Injection Vulnerability

Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to execute arbitrary commands via a specific interface, potentially enabling the attacker to access, modify, or delete sensitive information within the database.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Ecowatch Saas-composer Iot Edge Linux Docker Iot Edge Windows and 5 more
CVE-2026-28963

Visual Intelligence Privacy Violation in iPhone Mirroring

A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to use Visual Intelligence to access sensitive user data during iPhone Mirroring.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ios And Ipados Ipados Iphone Os