Search vulnerabilities

Expected end of text, found '/' (at char 47), (line:1, col:48)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,863

CVE-2026-84729

Buffer Overflow in ASUS Router Firmware Causes Denial of Service

Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or potentially cause a denial-of-service (DoS) via a crafted packet. Refer to the '  Security Update for ASUS Router Firmware  ' section on the ASUS Security Advisory for more information.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Asus
Products
Router Firmware
CVE-2026-77779

Improper access control vulnerability

ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized scope.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Zohocorp
Products
Manageengine Key Manager Plus
CVE-2026-64750

Out‑of‑Bounds Write in Image Processing Causing Memory Corruption

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may result in memory corruption.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ios And Ipados Ipados Iphone Os and 1 more
CVE-2026-62007

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-59263

Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt.

A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

CVSS 4.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Openoffice
CVE-2026-57775

WordPress Simple Cloudflare Turnstile plugin <= 1.44.1 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication Abuse.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-57639

WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roland Murg WP Booking System wp-booking-system allows Reflected XSS.This issue affects WP Booking System: from n/a through 2.1.0.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Roland Murg Wordpress-extensions
Products
Wp Booking System Wp Booking System
CVE-2026-119477

WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.05.003.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Jacob N. Breetvelt Wordpress-extensions
Products
Wp Photo Album Plus Wp Photo Album Plus
CVE-2026-118627

MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability

MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loading of SHAP explainer models. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30301.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Mlflow
Products
Mlflow Mlflow/mlflow
CVE-2026-118626

MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability

MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the configuration of the BEFORE_REQUEST_HANDLERS. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-32108.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mlflow
Products
Mlflow Mlflow/mlflow
CVE-2026-118625

MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability

MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the get_endpoints function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-32107.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mlflow
Products
Mlflow Mlflow/mlflow
CVE-2026-118624

MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability

MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the _find_validator function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-31894.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mlflow
Products
Mlflow Mlflow/mlflow
CVE-2026-118623

MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability

MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of pickle files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29513.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Mlflow
Products
Mlflow Mlflow/mlflow
CVE-2026-117553

Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning

Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Umbraco
Products
Umbraco Cms
CVE-2026-116891

SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate

SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Semantic-mediawiki
Products
Semantic Mediawiki
CVE-2026-116879

Semantic MediaWiki 7.3.0 before 7.3.1 Missing Authorization via smwtask Update Task

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to trigger forced reparsing, semantic-store writes, and resource-intensive dependency work.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Semantic-mediawiki
Products
Semantic Mediawiki
CVE-2026-116739

VMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Kisli
Products
Vmime
CVE-2026-116489

Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes

Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Timescale
Products
Pgvectorscale
CVE-2026-116200

Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()

Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Snipeitapp
Products
Snipe-it
CVE-2026-116176

vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Vllm Vllm-project
Products
Vllm Vllm