Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,471

CVE-2026-116958

Konflux-ci: unquoted variable expansion in shell command execution

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing commands with the privileges of the deployment runner.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-108060

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:CVE-2026-108060: Nombre in ‘/Trabajadores/Create’.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108059

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108059: Observaciones in ‘/Terceros/Create’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108058

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108058: Nombre in ‘/PlantillasMail/Edit’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108057

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108057: Nombre in ‘/PlantillasPdf/Edit/1273129’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108056

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108056: NombrePF in ‘/Empresas/Create’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108055

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108055: Nombre in ‘/Inmuebles/Create’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108054

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108054: Nombre in ‘/Familias/Edit/{id}’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108053

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108053: Nombre in ‘/CuentasCorrientes/Create’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108052

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108052: Codigo in ‘/CategoriasFicheros/Edit/{id}’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108051

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108051: Nombre in ‘/Articulos/Create’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108050

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108050: ReferenceOtherParty in ‘/Documents/DeliveryNotes/Edit/{id}’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108049

Clickjacking vulnerability in the Alosuite web application.

Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. By tricking a victim into interacting with a malicious web page, an attacker can trigger unwanted actions within the Alosuite application embedded in the frame, which could compromise the integrity of user interactions and facilitate further attacks against authenticated users.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108048

Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality.

Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or other controls against automation can harm legitimate users, consume application and email infrastructure resources, and facilitate automated attacks against the password recovery service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108046

Direct Object Reference (IDOR) vulnerability in Alosuite

Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By modifying the identifier provided to the ‘/Companies/Edit/{id}’ endpoint, an attacker can access information associated with other companies or users without the appropriate authorization. The vulnerability allows unauthenticated remote attackers to enumerate valid object identifiers and retrieve information that should be restricted to authorized users, resulting in the unauthorized disclosure of application data.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-105980

Command Injection in WireGuard VPN

Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Welotec
Products
Tk100 Tk500 V2 Tk500 V3
CVE-2026-103799

Missing Authorization in Dell PowerProtect Data Domain Management Center Enables Remote Unauthorized System Operations

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized system operation on managed systems.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerprotect Data Domain Management Center
CVE-2026-119574

Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service

Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Traefik
Products
Traefik
CVE-2026-99247

tracing: Do not initialize tracefs work if tracing is disabled

In the Linux kernel, the following vulnerability has been resolved: tracing: Do not initialize tracefs work if tracing is disabled If trace buffer allocation fails during early boot (e.g. in early_trace_init() -> allocate_trace_buffers()), tracing_disabled is left set to 1 and the global trace array events list remains uninitialized. Later during boot, tracer_init_tracefs() (invoked via fs_initcall) queues tracerfs_init_work asynchronously without checking if tracing was disabled. When tracer_init_tracefs_work_func() runs, it calls event_trace_init() and init_tracer_tracefs(&global_trace, NULL) unconditionally. This leads to __find_event_file() dereferencing an uninitialized tr->events list, causing an early boot NULL pointer dereference Oops: BUG: Kernel NULL pointer dereference on read at 0x00000010 Faulting instruction address: 0xc000000000485be0 Oops: Kernel access of bad area, sig: 7 [#1] ... NIP [c000000000485be0] __find_event_file+0x70/0x3c0 LR [c000000000448874] init_tracer_tracefs+0x274/0xc80 Call Trace: init_tracer_tracefs+0x274/0xc80 tracer_init_tracefs_work_func+0x50/0x320 process_one_work+0x1e8/0x5c0 worker_thread+0x1dc/0x3d0 kthread+0x194/0x1b0 start_kernel_thread+0x14/0x18 Check tracing_disabled at the beginning of tracer_init_tracefs_work_func() and return immediately if tracing is disabled or failed to initialize, preventing the crash.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Linux Kernel
CVE-2026-119718

Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Blender
Products
Blender