Search vulnerabilities

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,467

CVE-2026-119596

UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} endpoint to obtain zips of all torrents, disclosing private collection membership.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hdinnovations
Products
Unit3d
CVE-2026-119591

SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause

SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Sqlite
Products
Hummingbird Sqlite
CVE-2026-119575

ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Arcadedata
Products
Arcadedb
CVE-2026-119571

Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID

Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Parse Community Parseplatform
Products
Parse Server Parse-server
CVE-2026-119566

Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects

Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Prometheus
Products
Prometheus
CVE-2026-119562

phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Phpmyadmin
Products
Phpmyadmin
CVE-2026-119558

OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points

OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Opencart
Products
Opencart
CVE-2026-119554

Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Moodle
Products
Moodle
CVE-2026-119550

Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from unfiltered playlist ItemIds and then stream that hidden media.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Jellyfin
Products
Jellyfin
CVE-2026-119300

Wekan: ReDoS via Unescaped User Input in RegExp

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wekan
Products
Wekan
CVE-2026-119291

zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository, template, or archive with a symbolic link at a scaffolded name can cause setup to overwrite a target outside the selected directory with the invoking user's permissions. The .gitignore path requires no flag, while --force permits a linked launcher target to be written and made executable; import can also read link-target content and incorporate it into the generated build file. This issue is fixed in version 1.4.0.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Zuke-build
Products
Zuke
CVE-2026-119287

Zuke: Command-form registry descriptors bypass the MCP launch policy

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-run reads a registry writable by another party and a run-capable caller invokes the affected tool, the registry writer can choose the program and arguments executed with the operator's environment and workspace access. The --allow-run and --protect name globs do not contain the issue because the descriptor supplies those names, and the optional destructive confirmation displays a description controlled by the same writer. The local default registry populated only through zuke register is not affected because that command writes module-form descriptors. This issue is fixed in version 1.51.0.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Zuke-build
Products
Zuke
CVE-2026-112905

Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in version 1.0.8.7.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Givanz
Products
Vvveb
CVE-2026-112348

Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum Wordpress-extensions
Products
Kirki Kirki
CVE-2026-104064

Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Overflow via TIFF Tile Buffer Handling

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Scribus
Products
Scribus
CVE-2015-20130

Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view_server_log.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HTML response without output encoding. Attackers can craft a malicious URL and induce a user to request it, resulting in arbitrary JavaScript execution within the victim's browser session against the Netsweeper web administration interface. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Netsweeper
Products
Netsweeper
CVE-2026-73198

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Freeipa Redhat
Products
Freeipa Enterprise Linux Enterprise Linux Eus and 6 more
CVE-2026-73197

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Freeipa Redhat
Products
Freeipa Enterprise Linux Enterprise Linux Eus and 6 more
CVE-2026-72694

Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mrtgconfig Redhat
Products
Mrtg Enterprise Linux Enterprise Linux Eus and 6 more
CVE-2026-116776

USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS

USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in USB Test/src/driveinfo.cpp trusts DISK_GEOMETRY.BytesPerSector returned by IOCTL_DISK_GET_DRIVE_GEOMETRY without checking whether the call succeeded or enforcing size bounds. USB Test/src/drivetest.cpp uses the value for division and to size a heap buffer before memcpy(buffer.data(), &sector, 8), so a physically connected malicious USB storage device can report a value below eight bytes and cause repeated out-of-bounds writes, or report zero and cause a divide-by-zero denial of service when a user starts a drive test. The heap corruption can crash the elevated application and may permit arbitrary code execution. This issue is fixed in version 1.1.5.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
N-romanovich
Products
Usb-test