Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,508

Export CSV
CVE-2026-86284

jaychouchannel Tourism-Management-System CommonController.java getOption information disclosure

A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnerability is the function getOption of the file travel/src/main/java/com/controller/CommonController.java. The manipulation of the argument tableName/columnName leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. To fix this issue, it is recommended to deploy a patch.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jaychouchannel
Products
Tourism-management-system
CVE-2026-86272

Beijing Meite Software Technology U+Smart Enjoyment WebSite UploadFormImg.ashx unrestricted upload

A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000. This impacts an unknown function of the file /Report/Upload/UploadFormImg.ashx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Beijing Meite Software Technology
Products
U Smart Enjoyment Website
CVE-2026-86228

JeecgBoot AiragModelController.java exportXls access control

A security vulnerability has been detected in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java. Such manipulation of the argument credential leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.9.5 is able to resolve this issue. The name of the patch is a2be896f753936956ee6863b632b8e5a0231345c. You should upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecgboot
Products
Jeecgboot
CVE-2026-54213

TeamDavid: Denial of Service via endpoint 'internalRestart'

Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shut down when a specific endpoint (/internalRestart) is accessed. This endpoint is accessible to unauthenticated users over the public Internet. Instead of “restarting”, the server shuts completely down. As a result, a remote attacker can trigger a persistent denial of service by shutting down the web server without requiring authentication. Recovery requires manual administrator intervention to restart the service. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Tobit Laboratories Ag
Products
Teamdavid
CVE-2026-54208

TeamDavid: Arbitrary File Write leading to Stored XSS

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper validation or restriction on file types. As a result, an attacker can create files (e.g., .htm), containing malicious JavaScript code. When a user accesses a file created in this way, stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Tobit Laboratories Ag
Products
Teamdavid
CVE-2026-75168

Remote Authenticated File Write in MBS‑Solutions X‑Serie Gateway Firmware V6_00_05

An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mbs-solutions
Products
X-serie Gateway
CVE-2026-75793

SureCart < 4.7.0 - Unauthenticated Account Creation with Automatic Login

The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Surecart Wordpress
Products
Surecart Wordpress
CVE-2026-85401

Dolibarr Legacy File Manager config.inc.php access control

A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 23.0.4 can resolve this issue. This patch is called ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec. It is suggested to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dolibarr
Products
Dolibarr
CVE-2026-85208

itsourcecode Online Medicine Delivery System Order Management Controller controller.php doInsert unrestricted upload

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Itsourcecode
Products
Online Medicine Delivery System
CVE-2026-85147

Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain a specific password from the source code, which can be used to retrieve the AES encryption key used for communication.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Lightstar
Products
Smartit Desktop Manager
CVE-2026-82923

AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes

The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into the uploads directory, and delete site content and media. On a host that serves PHP from the uploads directory, that file write is remote code execution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-85517

code-projects Vehicle Management System SQL Database Backup File vehicle_management.sql information disclosure

A flaw has been found in code-projects Vehicle Management System 1.0. The impacted element is an unknown function of the file /vehicle_management.sql of the component SQL Database Backup File Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. The exploit has been published and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Code-projects
Products
Vehicle Management System
CVE-2026-19274

IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR name with no namespace disambiguation, allowing a same-named `InstanaAgent` CR in an attacker-controlled namespace to silently overwrite the shared `ClusterRoleBinding` or delete it outright and revoke the victim agent's cluster monitoring access.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Observability With Instana Agent
CVE-2026-71106

Unauthenticated HTTP Attack Enables System Takeover in Oracle Hospitality OPERA 5 Property Services

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.28.0-5.6.28.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Hospitality Opera 5 Property Services
CVE-2026-84045

E-cab Taxi Booking Manager for Woocommerce < 2.0.5 - Unauthenticated Price Manipulation via mptbm_add_to_cart

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-73762

Authorization Bypass in the API Endpoint of AOS-CX Leads to Unauthorized Access

A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable unauthorized access to management functionality that should be restricted by the configured access control policy.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more
CVE-2026-73752

Unauthenticated Arbitrary File Write Vulnerability Leads to Remote Code Execution in AOS-CX

An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more
CVE-2026-73749

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX

Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code execution with elevated privileges.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more
CVE-2026-73775

Authenticated Sensitive Information Disclosure Vulnerabilities in AOS-CX

Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-CX.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more
CVE-2026-12261

Improper Access Control in nltk/nltk

A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` instead of package-isolated roots, and validates package integrity only after the archive has been written and extracted. This design flaw enables one package to overwrite another package's trusted resources within the same namespace, making the changes immediately active through ordinary NLTK APIs. This issue persists across fresh interpreter restarts and can affect downstream workflows, including machine learning pipelines and reproducibility-sensitive environments.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Nltk
Products
Nltk Nltk/nltk