Search vulnerabilities

Expected end of text, found '/' (at char 18), (line:1, col:19)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,866

CVE-2026-103299

nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret

The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-106972

rybakit/msgpack: rybakit/msgpack: Denial of Service via uncontrolled recursion

Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested, attacker-controlled MessagePack input.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Rybakit
Products
Msgpack.php
CVE-2026-114555

Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions: from 0.0.0 to 2.0.14.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Data Field
CVE-2026-59386

Credential exposure to space supporter

A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Cloudfoundry
Products
Cf-deployment Cloud Controller
CVE-2026-59388

Cloud Controller exposes secrets in audit log

Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Cloudfoundry
Products
Cf-deployment Cloud Controller
CVE-2026-59385

Space Developer can extract space-scoped broker credentials

A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Cloudfoundry
Products
Cf-deployment Cloud Controller
CVE-2026-59387

Broken access control restriction in Cloud Controller API

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS.   An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Cloudfoundry
Products
Cf-deployment Cloud Controller
CVE-2026-75882

Improper access control vulnerability in ESET Encryption products for Windows

An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Eset
Products
Endpoint Encryption Full Disk Encryption
CVE-2026-119602

libmspack through 0.11alpha Uninitialized Memory Disclosure via MS-ZIP Decompressor Window

libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Kyzer Libmspack Project
Products
Libmspack Libmspack
CVE-2026-93327

Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution

A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. This vulnerability was patched on 11 September 2026, and no customer action is needed.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Application Integration
CVE-2026-48164

Collabora Online: Reflected HTML injection through host_session_id

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form parameter is substituted into the `cool.html` editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective `Content Security Policy`, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the `Content Security Policy` header sent by `coolwsd` mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Collaboraoffice
Products
Online
CVE-2026-62019

WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Liquid Web / Stellarwp Wordpress-extensions
Products
Bookit Bookit
CVE-2026-62023

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Unlimited-elements Wordpress-extensions
Products
Unlimited Elements For Elementor Unlimited Elements For Elementor
CVE-2026-79864

Unauthenticated Adjacent Command Injection Vulnerability in AOS-10

Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 9.6 Critical EPSS 1.5% KEV · Not listed
Vendors
Hpe
Products
Aos
CVE-2026-81396

Microsoft Excel Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Excel Excel 2016 and 8 more