Search vulnerabilities

Expected end of text, found '/' (at char 47), (line:1, col:48)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,120

CVE-2026-44344

Chamilo LMS: Conditional PHP execution through vendored QuickForm eval

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple `eval()` calls in the vendored PEAR `HTML_QuickForm` libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms use hardcoded element names; exploitation requires a developer-specific plugin or misconfiguration that lets user input reach those element names. Where that conditional path exists, the impact can be full server compromise. This issue is fixed in versions 1.11.40 and 2.0.1.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Chamilo
Products
Chamilo Lms
CVE-2026-119719

Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Blender
Products
Blender
CVE-2026-119715

NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers

NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-119711

PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints, enabling password spraying and OTP or password-reset email flooding.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Pipeshub
Products
Pipeshub
CVE-2026-119707

SonicJS through 3.0.0 Missing Authorization in Content Write API

SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sonicjs
Products
Sonicjs
CVE-2026-119703

xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device identifier can open an authenticated WebSocket session, issue voice-assistant commands, exchange audio, and read that device's conversation context.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Xinnan-tech
Products
Xiaozhi-esp32-server
CVE-2026-119699

WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpgraphql
Products
Wpgraphql Smart Cache Wpgraphql Smart Cache
CVE-2026-119663

Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create

Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId in a batch request to insert attacker-named resource rows listed by the victim's client.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wannabespace
Products
Tamery
CVE-2026-119659

Blossom through 1.17.1 Authorization Bypass via Folder Endpoints

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Blossom Wangyunf
Products
Blossom Blossom
CVE-2026-119655

CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList

CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Coreshop
Products
Coreshop
CVE-2026-119651

HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hulaspark
Products
Hula-server
CVE-2026-119647

RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}

RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/{deptId} with any department id to obtain usernames, nicknames, account status, last login IP and time, and remarks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dromara
Products
Ruoyi-vue-plus
CVE-2026-119596

UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} endpoint to obtain zips of all torrents, disclosing private collection membership.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hdinnovations
Products
Unit3d
CVE-2026-119591

SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause

SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Sqlite
Products
Hummingbird Sqlite
CVE-2026-119575

ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Arcadedata
Products
Arcadedb
CVE-2026-119571

Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID

Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Parse Community Parseplatform
Products
Parse Server Parse-server
CVE-2026-119566

Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects

Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Prometheus
Products
Prometheus
CVE-2026-119562

phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Phpmyadmin
Products
Phpmyadmin
CVE-2026-119558

OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points

OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Opencart
Products
Opencart
CVE-2026-119554

Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Moodle
Products
Moodle