Search vulnerabilities

Expected end of text, found ':' (at char 23), (line:1, col:24)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,601

CVE-2026-120463

Warracker before 1.0.4 Missing Authorization via Paperless-ngx Document Linking

Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the `other` document type. Attackers can exploit insufficient authorization checks in the `paperless_search_and_link()` and `serve_paperless_document()` route handlers in file_routes.py to retrieve and disclose private documents belonging to another user via the shared Paperless-ngx API credential, resulting in unauthorized read access and confidentiality loss.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Sassanix
Products
Warracker
CVE-2026-120454

The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sleuthkit
Products
The Sleuth Kit
CVE-2026-120446

madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API

madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.

CVSS 4.0 · 8.8 High EPSS 1.0% KEV · Not listed
Vendors
Madong-code
Products
Madong-admin-saas
CVE-2026-120430

Camaleon CMS before 2.9.2 IDOR via Admin::CategoriesController

Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Owen2345
Products
Camaleon Cms
CVE-2026-120426

OpenCSG CSGHub through v2.6.0-ce Unauthenticated Private Repository File Read via Resolve Route

OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files. Attackers can inject a percent-encoded current_user parameter into the file path, which the portal forwards with its server API key, to read files in private model, code or space repositories.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Opencsg
Products
Csghub
CVE-2026-120345

WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection

A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 10 Critical EPSS 2.0% KEV · Not listed
Vendors
Wavlink
Products
Wn551x3-a
CVE-2026-119712

PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents

PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pipeshub Pipeshub-ai
Products
Pipeshub Pipeshub-ai
CVE-2026-119708

abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context and return blobs stored by that tenant.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Colinin
Products
Abp-next-admin
CVE-2026-119704

Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcp

Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. Attackers inside a jail can plant symlinks pointing to host paths or other jail roots, so administrator-run copies overwrite or read host files with root privileges.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bastillebsd
Products
Bastille
CVE-2026-119700

WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpgraphql
Products
Wpgraphql Wpgraphql
CVE-2026-119664

Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update

Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wannabespace
Products
Tamery
CVE-2026-119660

MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Yincongcyincong
Products
Musebot
CVE-2026-119656

CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Coreshop
Products
Coreshop
CVE-2026-119652

HuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hulaspark
Products
Hula-server
CVE-2026-119648

BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail

Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tencent
Products
Blueking Cmdb
CVE-2026-119644

Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wangyunf
Products
Blossom
CVE-2026-119601

AFFLIB through 3.7.22 Heap Out-of-Bounds Write in af_get_page

AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the sector zero-fill loop to write past the buffer and crash forensic tools.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Afflib Project
Products
Afflib
CVE-2026-119597

OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Aidotnet
Products
Opendeepwiki
CVE-2026-119576

ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, altering query results returned to other users including administrators.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Arcadedata
Products
Arcadedb
CVE-2026-119567

vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Vsftpd Project
Products
Vsftpd