Search vulnerabilities

Expected end of text, found ':' (at char 23), (line:1, col:24)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,713

CVE-2026-97043

Unexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compile

Building a malicious package that uses cgo could bypass "#cgo LDFLAGS" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in "//go:cgo_ldflag" directives. When "cmd/cgo" generates "_cgo_gotypes.go", it quotes each "#cgo LDFLAGS" argument with strconv.Quote in a "//go:cgo_ldflag" directive, but "cmd/compile" and "cmd/go" parsed those directives by splitting on raw quote characters without handling backslash escapes or unquoting the string. This mismatch allowed disallowed linker flags or unvalidated linker search paths to be smuggled past the go command's flag checks and passed to the external linker. In addition, deduplicating LDFLAGS in the go command could panic with an out-of-bounds slice index when a prefix of the flag list matched near the end of the slice. "cmd/compile" and "cmd/go" now properly handle backslash-escaped quotes and unquote "//go:cgo_*" pragma strings with strconv.Unquote, and the slice bounds check in processCgoOutputs has been fixed.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97040

Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link

Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A ".syso" file beginning with a "go object" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as "cgo_ldflag" or "cgo_dynamic_linker") embedded in the ".syso" file to be passed to the external linker without validation. Additionally, ".syso" filenames longer than 16 bytes lost their ".syso" extension when truncated in archive headers, and unrecognized ".syso" formats forced external linking in pure-Go builds. The linker now rejects ".syso" files that are not recognized host object formats, and "cmd/go" and "cmd/pack" preserve the ".syso" suffix when truncating long archive member names.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125836

WordPress Simple JWT Login plugin <= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Nicu Micle Wordpress-extensions
Products
Simple Jwt Login Simple Jwt Login
CVE-2026-125870

BookStack before 26.09.3 Broken Access Control via ImageController

BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission() that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies on Page::getPage() which returns null for soft-deleted pages and silently skips the PageView check. Attackers can enumerate sequential image IDs via GET /images/edit/{id} to disclose metadata of restricted images, and users with image-update-all/image-delete-all privileges can rename, replace, or permanently delete images belonging to content they cannot view, persisting the damage even after the page is restored.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Bookstackapp
Products
Bookstack
CVE-2026-107484

Input Validation Vulnerability in Gaia Portal backend handlers allows privilege escalation by an authenticated user

An input and authorization validation vulnerability in Gaia Portal backend handlers could allow an authenticated, non-administrative user to perform privileged operations that should be restricted to administrators.

CVSS 3.1 · 7.3 High EPSS 1.9% KEV · Not listed
Vendors
Checkpoint
Products
Quantum Security Gateway Quantum Security Management
CVE-2026-116303

PostgreSQL foreign key and JSON conversions bypass EXECUTE privilege on cast functions

Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, to_json(), and others. A successful attack requires the attacker to search each database for access-restricted cast functions and identify confidentiality impact specific to each function implementation found. There are few or no practical examples of an access-restricted cast function or of a cast function having confidentiality impact. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-116304

PostgreSQL parallel RECORD typmod use-after-free executes arbitrary code

Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-116306

PostgreSQL composite-type change during field assignment executes arbitrary code

Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via changing a composite type between deforming and reforming a value. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-116307

PostgreSQL plperl prepared-query use-after-free executes arbitrary code

Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-127277

Linksys EA8100 SMB Service service_smbd.sh initialization

A security flaw has been discovered in Linksys EA8100 1.0.3.216940. The affected element is an unknown function of the file etc/init.d/service_smbd.sh of the component SMB Service. Performing a manipulation of the argument ANON_ACCESS results in improper initialization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Linksys
Products
Ea8100
CVE-2026-0169

Local Privilege Escalation via Debug Overlay Binding in Android.bp

In multiple functions of Android.bp, there is a possible way to bind to a privileged debug overlay service due to test or debugging code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-0101

Local Firmware Denial of Service via Unvalidated Quantity Input in AMD PMFW

Improper validation of specified quantities in input within AMD Power Management Firmware (PMFW) could allow a local attacker to pass unsanitized input, potentially resulting in a system crash or denial of service.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Amd
Products
Epyc 9005 Series Processors Epyc Embedded 9005 Series Processors
CVE-2025-54507

Improper Validation of Input in AMD SEV Firmware Allows Multiple RMP Entries, Compromising Guest Integrity

Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an attacker with administrative privileges to create multiple RMP entries for the same guest physical address, potentially resulting in loss of guest integrity.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Amd
Products
Epyc 9005 Series Processors Epyc Embedded 9005 Series Processors
CVE-2026-116310

PostgreSQL COPY error context uses freed field storage

Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row following an ignored or nullified conversion error. file_fdw reaches the same code path in affected version 18. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-116312

PostgreSQL MERGE can place the wrong row in a trigger transition table

Inconsistent transition-capture state in PostgreSQL MERGE allows a table data modifier to make an AFTER trigger process the wrong new row, via a partitioned table MERGE that performs an INSERT before an UPDATE. Within major versions 15-18, minor versions before PostgreSQL 18.7, 17.12, 16.16, and 15.20 are affected. Versions before PostgreSQL 15 are unaffected.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-116313

PostgreSQL "vacuumdb --missing-stats-only" lets a database owner execute code as the vacuumdb user

Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pg_upgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-116314

PostgreSQL pg_restore executes arbitrary code due to missing non-plain archive validation

Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg_restore OS process. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-116315

PostgreSQL tsvector_delete() heap buffer overflow executes arbitrary code

Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-116325

PostgreSQL reindexdb index name quoting allows SQL injection

SQL injection in PostgreSQL reindexdb allows an object creator to execute arbitrary SQL as the database user running reindexdb, via a crafted index name embedded in the parallel catalog query for --jobs with --index. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql