Search vulnerabilities

Expected end of text, found '/' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,471

CVE-2026-115786

Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion

A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation deletes the record and reverses its folder counters without reversing the mailbox-wide charge. Repeated normal share notifications therefore accumulate quota usage after the visible records are gone. On accounts with a finite quota, this can prevent incoming mail and other size-increasing operations without recipient interaction. The issue affects ZCS 10.1.16 and 10.1.20.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Synacor Zimbra
Products
Zimbra Collaboration Suite Zimbra Collaboration Suite
CVE-2026-95620

Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt

A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Qt
Products
Qt
CVE-2026-87901

phpBB Registration Module XSS Vulnerability

Improper sanitization in the registration module allows reflected Cross-Site Scripting.

CVSS 3.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Phpbb
Products
Phpbb
CVE-2026-79982

Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bt_hci_tx_sync_in() allocated that buffer from bt_hci_ep_pool, a fixed pool whose slots are only USBD_MAX_BULK_MPS bytes (64 on full-speed-only builds), and then performed net_buf_add_mem(buf, bt_buf->data, bt_buf->len) with no length check. HCI event and ACL buffers are sized by CONFIG_BT_BUF_EVT_RX_SIZE and CONFIG_BT_BUF_ACL_RX_SIZE and can be far larger, so the copy runs past the end of the 64-byte slot into the adjacent slots and into whatever follows the statically allocated pool. The device runs the local Bluetooth controller in raw HCI mode (CONFIG_BT_HCI_RAW), so the oversized packets originate over the air. With the HCI buffer sizes recommended for full-featured controllers, an unauthenticated attacker within Bluetooth range can supply the overflowing bytes: a connected peer that negotiates Data Length Extension can send ACL fragments up to CONFIG_BT_CTLR_DATA_LENGTH_MAX bytes, and an attacker that merely broadcasts extended advertising data reaches the same path through LE Extended Advertising Report events, which the controller fragments only to CONFIG_BT_BUF_EVT_RX_SIZE. In the stock configuration the overflow is already reached without any radio traffic: the mandatory Read Supported Commands command-complete event is 70 bytes and overruns the 64-byte slot by six bytes on every host initialization. Because net_buf_add_mem() validates tailroom only through an assertion unless CONFIG_NET_BUF_HARDENING is enabled, builds with CONFIG_ASSERT=n — the usual production setting — silently corrupt memory adjacent to the USB buffer pool with attacker-chosen contents, which on a target without memory protection between subsystems can lead to arbitrary code execution. Builds with assertions enabled fail the assertion instead and panic, giving a remotely triggerable denial of service. The fix introduces a separate bt_hci_tx_pool sized to MAX(BT_BUF_ACL_RX_SIZE, BT_BUF_EVT_RX_SIZE) for the controller-to-host direction while leaving the host-to-device pool at the endpoint packet size, which is already bounds-checked during reassembly.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Zephyrproject
Products
Zephyr
CVE-2026-63244

Authentication Bypass Vulnerability

An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request, potentially resulting in unauthorised access to user accounts and full administrative control of the LMS platform.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wizlearn Technologies
Products
Learning Management System
CVE-2026-63243

Firmware verification vulnerability

An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana could allow an attacker within Bluetooth range to connect to an affected device without prior pairing or authentication.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Creative Labs
Products
Creative Sound Blaster Katana
CVE-2026-62989

Shopper: missing variant-delete authorization permits destructive single and bulk actions

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `DeleteAction` and `DeleteBulkAction` without server-side authorization. An authenticated staff user with `edit_products` can access `/shopper/products/{id}/edit` and obtain the signed component state even without `delete_product_variants`. The `callTableAction` and `callTableBulkAction` paths then permanently delete individual or multiple variants without checking that dedicated permission. For variant products, this can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. This issue is fixed in version 2.10.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Shopperlabs
Products
Shopper
CVE-2026-120491

Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page

Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin_get_lastconn.html XML to forge a connection id, which executes in administrators' browsers when admin_connection_list.html auto-refreshes, enabling Lua console abuse.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wftpserver
Products
Wing Ftp Server
CVE-2026-120461

Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch

Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Dromara
Products
Jpom
CVE-2026-120453

The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr_size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sleuthkit
Products
The Sleuth Kit
CVE-2026-120449

Outline before 1.12.0 Improper Access Control via Public Document Shares

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Getoutline
Products
Outline
CVE-2026-120441

OwnTone Server through 29.3 SQL Injection via MPD sticker find Command

OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Owntone
Products
Owntone-server Owntone Server
CVE-2026-120429

Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController

Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Owen2345
Products
Camaleon Cms
CVE-2026-119343

Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized /api/v1/convert/html/pdf control path. HTTP and HTTPS resource references can make server-side requests to internal or cloud-metadata destinations, while file references can embed local content readable by the Stirling-PDF process into the generated PDF. The endpoint is reachable without credentials when security.enableLogin is false, and the flaw is distinct from earlier Stirling-PDF WeasyPrint vulnerabilities in older conversion paths. This issue is fixed in version 3.0.0.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Stirling
Products
Stirling Pdf
CVE-2026-119329

Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every selected owner when isArchived=true. A view-only partner could therefore enumerate the GPS coordinates and existence of a sharer's archived photos or videos even though the timeline and direct-access paths exclude archived partner assets. The exposure is limited to location metadata and asset identifiers because image bytes remain protected by checkPartnerAccess. This issue is fixed in version 3.0.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Immich-app
Products
Immich
CVE-2026-117603

Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass

Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Electrum
Products
Electrum
CVE-2026-117570

nmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilities

Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos, brute, or intrusive to nmap --script, running intrusive, brute-force, exploit, or denial-of-service scripts against scan targets.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Vorota-ai
Products
Nmap-mcp
CVE-2026-117566

EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Easyimages2.0 Project
Products
Easyimages2.0
CVE-2026-117562

rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint

rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Anyant
Products
Rssant
CVE-2026-117558

ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status

The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync(), letting prompt-injected agents execute commands as the MCP server user.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Ai-sdlc-framework
Products
Ai-sdlc