Search vulnerabilities

Expected end of text, found '/' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,857

CVE-2026-113689

Stored Cross-Site Scripting in BMC ITSM Work Notes

Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Bmc It Service Management Suite
CVE-2026-113690

Stored Cross-Site Scripting in BMC ITSM Attachments

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Bmc It Service Management Suite
CVE-2026-113691

Stored Cross-Site Scripting in BMC ITSM Knowledge Articles

Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Bmc It Service Management Suite
CVE-2026-119049

FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Idinging
Products
Freemail
CVE-2026-113692

Path Traversal in BMC ITSM

Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Bmc It Service Management Suite
CVE-2026-113693

System Account Credential Disclosure in BMC ITSM

Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Bmc It Service Management Suite
CVE-2026-113694

Improper Authorization in BMC ITSM SmartIT Attachments

Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Bmc It Service Management Suite
CVE-2026-113695

Reflected Cross-Site Scripting in BMC ITSM SmartIT

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Bmc It Service Management Suite
CVE-2026-113696

Improper Authorization in BMC ITSM SmartIT Change Approvals

Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Bmc It Service Management Suite
CVE-2026-113697

Reflected Cross-Site Scripting in BMC Helix Operations Management

Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Bmc Helix Operations Management
CVE-2026-119251

Privilege Escalation via Improper Access Control in Ubiquiti WiFiman Desktop for macOS

A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host device.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ubiquiti
Products
Wifiman Desktop For Macos
CVE-2026-119325

Bricks Theme Broken Access Control via load_popup_content

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Bricks Wordpress-extensions
Products
Bricks Theme Bricks Theme
CVE-2026-61645

Docat has Arbitrary File Upload exists in Upload API

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Docat-org
Products
Docat
CVE-2023-22793

Unauthenticated Remote Code Execution in Veeam Management Pack for Microsoft System Center

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Veeam
Products
Management Pack For Microsoft System Center
CVE-2026-107239

Remote Code Execution via Veeam Management Pack Collector

A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Veeam
Products
Management Pack For Microsoft System Center
CVE-2026-107238

Authenticated Domain User Enables LocalSystem RCE in Veeam Management Pack

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Veeam
Products
Management Pack For Microsoft System Center
CVE-2026-92744

Delinea Privilege Manager agent unauthenticated remote code execution vulnerability

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Delinea
Products
Privilege Manager
CVE-2026-119713

Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through a shell as the Paperclip server process, executing attacker-chosen OS commands on the server host.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Paperclip Paperclipai
Products
Paperclipai/server Paperclipai\/server Paperclipai/server
CVE-2026-97638

Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared "continue later" link; the nominally present nonce check is effectively bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpmudev
Products
Forminator Forms Forminator Forms
CVE-2026-87941

Patreon - Critical - Unsupported - SA-CONTRIB-2026-139

Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Patreon