Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,468

CVE-2026-96379

CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Cookiecuttr
CVE-2026-96363

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-87938

CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Csp Log
CVE-2026-79867

Authentication Bypass Leading to Remote Code Execution in AOS-8

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos
CVE-2026-79875

Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Access

A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos
CVE-2026-108763

Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR

The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpswings
Products
Wallet System For Woocommerce Wallet System For Woocommerce
CVE-2026-110983

WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF

The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wppa
Products
Wp Photo Album Plus Wp Photo Album Plus
CVE-2026-107028

android-shoppinglist: android-shoppinglist: Unauthorized data manipulation via insecure exported component permissions

Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-107039

Insecure Permissions Allow Device Reset or DoS in NetGuard No-Root Firewall

Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 allows unauthorized attackers to arbitrarily force a device reset or Denial of Service (DoS).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-107049

Arbitrary Storage Settings Modification via Crafted URI in Forkyz

An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-107055

Insecure Permissions in AppML NeutriNote Autosave Allow Arbitrary File Write

Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-62839

Hard-coded Cryptographic Key #1

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems Qnap Systems Inc.
Products
Hybrid Backup Sync Hbs 3 Hybrid Backup Sync Hbs 3 Hybrid Backup Sync
CVE-2025-62841

Hard-coded Cryptographic Key #2

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems Qnap Systems Inc.
Products
Hybrid Backup Sync Hbs 3 Hybrid Backup Sync Hbs 3 Hybrid Backup Sync
CVE-2023-7357

FlexNet Publisher lmadmin Rogue Vendor Daemon Vulnerability

A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addressed in the FlexNet Publisher 2023 R2 (11.19.4.0) release.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Flexera
Products
Flexnet Publisher
CVE-2026-118763

@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn() method that stores registry Authorization and Docker configuration headers as defaults on a shared HTTP client, while RegistryClient.uploadBlob() sends a fresh PUT to an absolute blob-upload Location supplied by the registry without checking that its origin or scheme matches the registry. A malicious or compromised registry can therefore direct a user pushing an artifact through attachArtifactToImage() to an attacker-controlled host and receive the registry bearer token, Basic credentials, or custom authentication headers. Redirect-time header stripping does not prevent the leak because the cross-host PUT is a new explicit request rather than a followed redirect. This is a residual of CVE-2026-59891, whose fix changed credential selection in credentials.ts but did not constrain where credentials are sent from registry.ts. Version 0.7.2 fixes the issue by separating registry credentials from client-wide defaults and sending them only to the registry origin.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Sigstore
Products
Sigstore
CVE-2026-119560

OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Opnsense
Products
Core Opnsense
CVE-2026-13747

Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint

The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to enumerate and read metadata — including post ID, title, date, author, and status — of all private and draft posts on the site, including those authored by other users.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tigroumeow Wordpress-extensions
Products
Meow Gallery Meow Gallery
CVE-2026-118205

Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the `register_user()` function. The vulnerability exists because the handler's post status deny-list rejects `future`, `draft`, and `pending` but admits `inherit` — the status carried by every WordPress revision — allowing an attacker to substitute a revision ID for a live page ID, while a flawed "last saved by administrator" check reads `post_author` on revisions (which reflects the editing administrator) rather than the `_edit_last` meta that is never copied to revisions, and the nonce gate is rendered ineffective because any unauthenticated visitor can freely obtain a valid nonce via the `wp_ajax_nopriv_eael_get_token` endpoint. This makes it possible for unauthenticated attackers to register an account with a role as high as Editor — gaining capabilities including `edit_others_posts`, `publish_pages`, `upload_files`, and `unfiltered_html` — by naming a revision whose `_elementor_data` contains an elevated role an administrator previously saved and later reverted on a page bearing the Login/Register widget. Successful exploitation requires that the site has "Anyone can register" enabled and that an administrator has at some point saved and then reverted a non-default "New User Role" on an affected page.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpdevteam
Products
Essential Addons For Elementor Essential Addons For Elementor
CVE-2026-87058

olm-operator-konflux-sample: olm-operator-konflux-sample: Hermetic build disabled by default; bundle build performs live network fetches

A flaw was found in olm-operator-konflux-sample. The hermetic build mode is disabled by default, allowing bundle builds to perform live network fetches. This means that external, unverified resources can be pulled during the build process, potentially compromising the integrity and trustworthiness of the resulting software artifacts. This introduces a supply chain risk where the final product might contain unintended or malicious code.

CVSS 3.1 · 2.6 Low EPSS n/a KEV · Not listed
Vendors
Olm-operator-konflux-sample
Products
Olm-operator-konflux-sample