Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,500

CVE-2026-113695

Reflected Cross-Site Scripting in BMC ITSM SmartIT

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Bmc It Service Management Suite
CVE-2026-113696

Improper Authorization in BMC ITSM SmartIT Change Approvals

Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Bmc It Service Management Suite
CVE-2026-113697

Reflected Cross-Site Scripting in BMC Helix Operations Management

Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Bmc Helix Operations Management
CVE-2026-119251

Privilege Escalation via Improper Access Control in Ubiquiti WiFiman Desktop for macOS

A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host device.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ubiquiti
Products
Wifiman Desktop For Macos
CVE-2026-119325

Bricks Theme Broken Access Control via load_popup_content

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Bricks Wordpress-extensions
Products
Bricks Theme Bricks Theme
CVE-2026-61645

Docat has Arbitrary File Upload exists in Upload API

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Docat-org
Products
Docat
CVE-2023-22793

Unauthenticated Remote Code Execution in Veeam Management Pack for Microsoft System Center

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Veeam
Products
Management Pack For Microsoft System Center
CVE-2026-107239

Remote Code Execution via Veeam Management Pack Collector

A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Veeam
Products
Management Pack For Microsoft System Center
CVE-2026-107238

Authenticated Domain User Enables LocalSystem RCE in Veeam Management Pack

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Veeam
Products
Management Pack For Microsoft System Center
CVE-2026-92744

Delinea Privilege Manager agent unauthenticated remote code execution vulnerability

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Delinea
Products
Privilege Manager
CVE-2026-119713

Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through a shell as the Paperclip server process, executing attacker-chosen OS commands on the server host.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Paperclip Paperclipai
Products
Paperclipai/server Paperclipai\/server Paperclipai/server
CVE-2026-97638

Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared "continue later" link; the nominally present nonce check is effectively bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpmudev
Products
Forminator Forms Forminator Forms
CVE-2026-87941

Patreon - Critical - Unsupported - SA-CONTRIB-2026-139

Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Patreon
CVE-2026-79876

Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing

A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos
CVE-2026-107034

Insecure Permissions Allowing Unauthorized Reading of User Notes in LeafPad

Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-107060

tailscale: Tailscale: Unauthorized modification of VPN configurations via insecure permissions

Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Tailscale
Products
Tailscale
CVE-2026-107262

Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Advanced Filesystem
CVE-2026-107308

Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Country
CVE-2026-107306

Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Menu Link Attributes
CVE-2026-3322

Privilege escalation via request replaying in Lobster_pro

Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Lobster Gmbh
Products
Lobster Pro