Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,805

Export CSV
CVE-2026-115385

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access can call set-times or set-times-at with negative seconds timestamps before the epoch, triggering an assertion failure that crashes the host.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Bytecodealliance
Products
Wasmtime
CVE-2026-115381

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge zero-filled writes, exhausting host memory and causing denial of service.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Bytecodealliance
Products
Wasmtime
CVE-2026-115380

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming or checking fuel. Malicious guest modules can pass many subscriptions to force long-running host computation that ignores configured fuel limits.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Bytecodealliance
Products
Wasmtime
CVE-2026-115366

OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed plugins through a child namespace's sys/ mount, causing denial of service.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Openbao
Products
Openbao
CVE-2026-115349

Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Lepture Mistune Project
Products
Mistune Mistune
CVE-2026-115347

Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Mistune Project
Products
Mistune
CVE-2026-114459

Mod_qos: out-of-bounds reads in response-body substring matching

A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an Apache worker process to crash and resulting in a Denial of Service (DoS).

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Pbuchbinder
Products
Mod Qos
CVE-2026-114458

Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow

A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, allowing more connection records to be added than the allocated buffer can hold. This issue leads to heap memory corruption, which can crash the web server process.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Pbuchbinder
Products
Mod Qos
CVE-2026-114457

Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads

A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated memory boundaries, which can cause an Apache worker process to crash.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Pbuchbinder
Products
Mod Qos
CVE-2026-112955

ApostropheCMS: Import archives can exhaust server storage and deny service

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apostrophecms
Products
Apostrophecms Import-export
CVE-2026-110205

Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution

Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match allowlisted prefixes, executing denied commands without user approval when auto-approval is enabled.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Roocode
Products
Roo-code Roo Code
CVE-2026-110127

waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wayn111
Products
Waynboot-mall
CVE-2026-110122

PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pickmall
Products
Lilishop
CVE-2026-110117

SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController

SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpoints to disable login lockout and two-factor login, weaken password rules, and clear lockout records.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
1024-lab
Products
Smartadmin
CVE-2026-110110

JetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack the save action annotation, attackers can toggle alarms by id to silence alerts for monitored devices.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jetlinks
Products
Jetlinks Community
CVE-2026-110105

B3log Symphony through 3.6.4 Missing Authorization in Admin Console Routes

B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can request /admin/report/ignore/{reportId}, /admin/tags/remove-unused, or /admin/user/{userId}/init-point to ignore reports, delete unused tags, or grant points without audit logging.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
B3log
Products
Symphony
CVE-2026-110100

Jorani before 1.0.4 Missing Authorization and SSRF via Contracts::import()

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse get_headers() and fopen() for server-side request forgery against internal hosts.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jorani
Products
Jorani
CVE-2026-109966

yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/ws to make yt-dlp load attacker-chosen JSON files from the server filesystem, with contents reflected in responses.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Marcopiovanello
Products
Yt-dlp-web-ui
CVE-2026-109961

Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members

Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can embed newline characters that the REBUILD_NSSUSERS cron writes unsanitized into /var/lib/extrausers/group, creating privileged group entries for local privilege escalation.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Froxlor
Products
Froxlor
CVE-2026-109956

NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Nltk
Products
Nltk