Search vulnerabilities

Expected end of text, found '@' (at char 12), (line:1, col:13)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,601

CVE-2026-79864

Unauthenticated Adjacent Command Injection Vulnerability in AOS-10

Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 9.6 Critical EPSS 1.5% KEV · Not listed
Vendors
Hpe
Products
Aos
CVE-2026-81396

Microsoft Excel Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Excel Excel 2016 and 8 more
CVE-2026-64918

Microsoft Office Spoofing Vulnerability

Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office 2016 Office 2019 and 2 more
CVE-2026-78403

Unauthenticated Stack Buffer Overflow in Sentinel Keys Server

Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. It may lead to remote code execution as NT AUTHORITY\SYSTEM. This issue affects Sentinel Keys Server: versions lower than 1.3.8.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Thalesgroup
Products
Sentinel Keys Server
CVE-2026-57201

Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 `ooTrace()` trace-logging function can occur when unbounded `vsprintf` writes into a fixed `2048-byte buffer`. A remote attacker may send a carefully crafted packet that causes the Asterisk process to crash. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Asterisk
Products
Asterisk Certified Asterisk
CVE-2026-57200

Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, under certain conditions, execute write operations through `REST-over-WebSocket`. The authorization bypass permits `arbitrary module path` loading and conditional remote code execution. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Asterisk
Products
Asterisk Certified Asterisk
CVE-2026-57188

Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in `res_xmpp` `XMPP namespace prefix` handling using carefully crafted packets. The `res_xmpp` module must be loaded, an XMPP connection must be configured in `xmpp.conf`, and the attacker must have an XMPP account on the same or a federated server. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Asterisk
Products
Asterisk Certified Asterisk
CVE-2026-57185

Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the `PJSIP MWI body parser` by sending a carefully crafted `SIP NOTIFY` request. The attacker must pass SIP authentication using either a username/password or `source IP address matching`. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Asterisk
Products
Asterisk Certified Asterisk
CVE-2026-116672

Authlib RFC 7592 examples omit registration-access-token client binding

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Authlib
Products
Authlib
CVE-2026-114620

Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request_uri parameter to the abstract get_request_object() hook before applying a destination or registration policy; the hook itself performs no network request, while the documentation demonstrates an unrestricted HTTP fetch. In deployments whose integrator implements that hook as an unrestricted outbound fetch, a remote attacker who knows a valid public client identifier can make the authorization server request internal, link-local, or otherwise unintended URLs and can distinguish fetch outcomes through different error responses and timing. Deployments whose custom hook already applies a secure allowlist, destination controls, and retrieval limits are not affected. The JWTAuthenticationRequest implementation in authlib/oauth2/rfc9101/authorization_server.py forwards request_uri to get_request_object() before an application-approved retrieval policy accepts the destination. This issue is fixed in version 1.9.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Authlib
Products
Authlib
CVE-2026-114127

Astro: Arbitrary CSS injection in Astro View Transitions

Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties within their generated declarations. An application that passes attacker-controlled data into properties such as duration, delay, easing, direction, fillMode, or animation names can allow CSS delimiters to terminate the declaration and add attacker-selected rules to the server-rendered page. The generated stylesheet still escapes literal less-than characters, so the injected content cannot terminate the style element or directly inject HTML or JavaScript. The injected CSS can conceal or reposition content, add generated text, and otherwise misrepresent the interface; some applications may also expose data already present in selectable DOM attributes through conditional resource loads. This issue is fixed in 7.3.3.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Astro Withastro
Products
Astro Astro
CVE-2026-107312

Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Examples For Developers
CVE-2026-79860

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8

Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos
CVE-2026-79861

Unauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10

There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 9.8 Critical EPSS 1.7% KEV · Not listed
Vendors
—
Products
—