Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,596

Export CSV
CVE-2026-102118

Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation

A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to escalate to root privileges on the appliance.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Accellion Kiteworks
Products
Kiteworks Core
CVE-2026-106378

chromium-browser: Privilege elevation in Sandbox

Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Apple Google
Products
Macos Chrome
CVE-2026-104892

Plane: Plaintext logging of API token

Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Makeplane
Products
Plane
CVE-2026-105147

SciPhi-AI R2R JWT Secret hard-coded credentials

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sciphi-ai
Products
R2r
CVE-2026-105141

topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get_user_id_by_email of the file cognee/modules/users/authentication/get_api_auth_backend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPI_USERS_JWT_SECRET results in hard-coded credentials. The attack may be launched remotely. Upgrading to version 1.6.0 is sufficient to fix this issue. The patch is identified as fa65fc0cd86cdba48d19aa76e36be862be982f5d. Upgrading the affected component is advised.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Topoteretes
Products
Cognee
CVE-2026-87061

olm-operator-konflux-sample: olm-operator-konflux-sample: bundle-hack/update_bundle.sh lacks fail-fast shell options

A flaw was found in olm-operator-konflux-sample. The `bundle-hack/update_bundle.sh` script lacks mechanisms to stop execution immediately upon encountering an error. This oversight allows critical data processing steps, such as those involving `skopeo` or `jq` commands, to fail silently and proceed with outdated or incomplete information. Consequently, this could lead to data integrity issues within the system.

CVSS 3.1 · 2.6 Low EPSS n/a KEV · Not listed
Vendors
Olm-operator-konflux-sample
Products
Olm-operator-konflux-sample
CVE-2026-97572

bnxt_en: Propagate RX ring init failures in bnxt_init_nic()

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() bnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring() fails, but bnxt_init_nic() discards that return value and calls bnxt_init_chip(), which enables TPA. If an allocation fails, this could leave rxr->rx_tpa[] partially zeroed and TPA would be enabled over an array with zeroed entries. This would lead to a zeroed DMA address being handed out if the agg_idx is translated to a SW index at a zeroed entry. Fix this by propagating the error out of bnxt_init_nic(). Both callers already check its return value and unwind with bnxt_free_skbs() and bnxt_free_mem(), which tolerate a partially initialized RX ring.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-97542

xfs: bail out on bitmap errors in xrep_agfl_fill

In the Linux kernel, the following vulnerability has been resolved: xfs: bail out on bitmap errors in xrep_agfl_fill LOLLM also points out that the xagb_bitmap_set call in xrep_agfl_fill can fail, but we don't check the result of xagb_bitmap_walk, so we silently drop the error and proceed with inconsistent incore data. That shouldn't be allowed.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-97522

mptcp: fix bad accounting in __mptcp_subflow_push_pending()

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix bad accounting in __mptcp_subflow_push_pending() If __subflow_push_pending() errors out we should avoid updating the copied byte counters, to avoid mismatch push call later on.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-97407

ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt

In the Linux kernel, the following vulnerability has been resolved: ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt rockchip_pdm_set_fmt() calls pm_runtime_get_sync() before accessing hardware registers, but ignores its return value. If the runtime resume fails, the function continues to perform register accesses while the device state is undefined. Replace pm_runtime_get_sync() with pm_runtime_resume_and_get() and return early on failure to avoid unpowered register accesses.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-18397

SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Thales
Products
Sconnect
CVE-2026-53605

Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant

Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4, the Reachy Mini Wireless OS image shipped with an overly broad sudoers entry granting the pollen daemon user (uid 1000) passwordless sudo access to /usr/bin/systemctl with no subcommand or argument restriction. This is a local privilege escalation (LPE). Any process running as pollen can obtain full root (uid 0) on the device in three commands, with no additional vulnerability required and no user interaction. This issue has been patched in version 0.2.4.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Pollen-robotics
Products
Reachy Mini
CVE-2026-87910

tarfile hardlink fallback ignores custom extraction filter rejection via None

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2026-55094

Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Taskcluster
Products
Taskcluster
CVE-2026-103548

Improperly Stored Credentials

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Itron
Products
Mv-90 Xi
CVE-2026-66246

HCL iControl is affected by multiple security vulnerabilities

iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modification or deletion of sensitive application data.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Icontrol
CVE-2026-95316

chromium-browser: chromium-browser: Unchecked return value in Performance

Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. (Chromium security severity: Low)

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-98002

iommu/amd: Fix ineffective error check in nested domain allocation

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amd_iommu_pdom_id_alloc() returns an int: a domain ID on success, or the negative errno from ida_alloc_range() when the ID space is exhausted or memory is short. amd_iommu_alloc_domain_nested() stores that return value in gdom_info->hdom_id, which is a u32, and only then tests it: gdom_info->hdom_id = amd_iommu_pdom_id_alloc(); if (gdom_info->hdom_id <= 0) { The assignment discards the sign, so -ENOSPC becomes 0xffffffe4 and the test never fires. The nested domain is then set up with a host domain ID that was never allocated, instead of the allocation failing with -ENOSPC. Keep the value in an int, test it there, and store it only once it is known to be valid, which is what the other amd_iommu_pdom_id_alloc() callers already do.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-40550

Privilege Escalation in multiple BinSoft products

Multiple BinSoft products are vulnerable to Privilege Escalation due to excessive database privileges assigned to the user used by the application. An attacker with access to any running application instance connected to the backend server can extract database credentials from the application’s memory by inspecting the running process. While ability to retrieve credentials from memory is the expected behavior, the exposed credentials grant administrative access to the database, exceeding the privileges required for normal application functionality. This allows an attacker to perform actions beyond those permitted through the application interface. The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Binsoft
Products
Mpgabinet