Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,588

Export CSV
CVE-2026-120869

An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance

An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-75491

Cudy TR3000 before 2.5.42 MQTT JWT Authentication Bypass via alg none Tokens

Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so that accepts unsigned JWTs using alg none. Attackers holding any Cudy-trusted client certificate can authenticate as admincudydevice on port 8883 and publish batchcmd requests to execute commands as root.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-75495

Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Password Parameter

Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying a crafted InternetGatewayDevice.User.{i}.Password value. Attackers can send a SetParameterValues request with shell metacharacters that obuspa_system.lua concatenates into a luci.util.exec() command string, gaining root command execution.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126265

SiYuan 2.1.0 before 3.8.9 CAPTCHA Bypass via Stale Login Cookie

SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, allowing reuse of a solved challenge. Attackers can replay the original signed siyuan cookie with distinct wrong access codes to brute-force the code and gain an administrator session.

CVSS 4.0 · 9.1 Critical EPSS n/a KEV · Not listed
Vendors
B3log
Products
Siyuan
CVE-2026-126269

NocoDB before 2026.09.0 Stored XSS via Attachment MIME Type

NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so the /dltemp signed URL serves HTML inline, stealing session tokens from localStorage to impersonate victims.

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126273

NocoDB before 2026.09.0 Privilege Escalation via Incomplete Admin Bootstrap

NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on a fresh instance to receive Creator and Super Admin roles, gaining full administrative control.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126274

NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog

NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage.

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126280

NocoDB before 2026.08.0 Refresh Token Reuse via Non-Atomic Rotation

NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid authenticated session, and no reuse event is recorded.

CVSS 4.0 · 9.1 Critical EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126315

Frappe HRMS 16.14.0 before 16.20.1 Telemetry Setting Bypass Information Exposure

Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is disabled.

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126377

Vvveb before 1.0.9.0 Cookie Forgery via PHP Type Juggling in generateCookie()

Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that uses loose comparison to validate MD5 cookie hashes. Unauthenticated attackers can brute-force cookie values until the server's MD5 computation yields a 0e magic hash, then forge persistent cookies for account takeover.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126378

Vvveb through 1.0.8.6 Webshell Upload via Theme Installer validFile() Bypass

Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos() instead of strict path matching. Attackers with admin credentials can upload a ZIP containing a PHP file whose path includes /theme.php to achieve remote code execution on nginx deployments.

CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126380

Vvveb before 1.0.9.0 RCE via .phar Extension Denylist Bypass in Media Upload

Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary OS commands as the web-server user.

CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126473

OpenEMR before 8.4.0 OAuth Authorization Bypass via Scope Canonicalization

OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records.

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126937

Zipline before 4.6.5 TOCTOU Race Condition via /api/setup

Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneous requests with spoofed X-Forwarded-For headers during the argon2 hashing window to gain full administrative control of the instance.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126945

Zipline before 4.5.1 Stored XSS via HighlightCode Component

Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf.

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126952

Zipline through 4.4.0 WebAuthn Authentication Bypass via Passkey Login

Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can impersonate that account without its authenticator, potentially gaining administrative control over SUPERADMIN accounts.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126953

Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Username

Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying an unvalidated InternetGatewayDevice.User.{i}.Username value. Attackers can send a SetParameterValues request with shell metacharacters that set_UserUsername() in obuspa_system.lua passes to os.execute(), gaining root command execution.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-127073

OpsTree BuildPiper before 2.7.0 Privilege Escalation via Additional Manifest

OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to cluster-admin, which the pipeline applies with cluster-wide credentials, granting control over all workloads and secrets.

CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-127079

OpsTree BuildPiper before 2.7.0 OTP Brute Force via password_reset/check_otp

OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the target's password and taking over the account.

CVSS 4.0 · 9.1 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-127080

OpsTree BuildPiper before 2.7.0 Container Escape via Unrestricted HostPath Volumes

OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise.

CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—