Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,057

Export CSV
CVE-2026-72153

irqchip/crossbar: Use correct index in crossbar_domain_free()

In the Linux kernel, the following vulnerability has been resolved: irqchip/crossbar: Use correct index in crossbar_domain_free() crossbar_domain_free() resets the domain data and then uses the nulled out irq_data->hwirq member as index to reset the irq_map[] entry and to write the relevant crossbar register with a safe entry. That means it never frees the correct index and keeps the crossbar register connection to the source interrupt active. If it would not reset the domain data, then this would be even worse as irq_data->hwirq holds the source interrupt number, but both the map and register index need the corresponding GIC SPI number and not the source interrupt number. This might even result in an out of bounds access as the source interrupt number can be higher than the maximal index space. Fix this by using the GIC SPI index from the parent domain's irq_data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-72081

scsi: elx: efct: Fix I/O leak on unsupported additional CDB

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efct_dispatch_fcp_cmd() allocates an efct_io before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO before handing the IO to the SCSI layer. Free the allocated IO before returning from this error path.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-72026

irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure

In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsic_early_acpi_init() allocates a firmware node before setting up the IMSIC state. If imsic_setup_state() fails, the function returns without freeing the allocated fwnode. Free the fwnode and clear the global pointer on this error path, matching the cleanup already done when imsic_early_probe() fails. [ tglx: Use a common cleanup path instead of copying code around ]

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-72006

net/mlx5: free mlx5_st_idx_data on final dealloc

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5_st_idx_data on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints (e.g. churning RDMA MRs) leak one struct mlx5_st_idx_data per cycle; kmemleak flags it as unreferenced and the kmalloc slab grows over time. When the last reference to an ST table entry is dropped, mlx5_st_dealloc_index() removed the entry from idx_xa but the backing mlx5_st_idx_data allocation was never freed. Free idx_data after the xa_erase() so the lifetime of the bookkeeping struct matches the lifetime of the ST entry it tracks.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-68468

mtd: virt-concat: free duplicate generated name

In the Linux kernel, the following vulnerability has been resolved: mtd: virt-concat: free duplicate generated name Every MTD registration runs mtd_virt_concat_create_join(). Once a virtual concat has already been registered, the function builds the same name again and takes the equal-name branch. That branch skips to the next item without freeing the newly allocated string. Free the temporary name before continuing.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-56859

Add recursion depth guard during decode in encoding/xml

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Go Standard Library
Products
Encoding/xml
CVE-2026-56860

Avoid quadratic complexity in resolvePath in net/url

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Go Standard Library
Products
Net/url
CVE-2026-70455

rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Rsync Project Samba
Products
Rsync Rsync
CVE-2026-33818

Enforce maximum recursion depth in encoding/asn1

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Go Standard Library
Products
Encoding/asn1
CVE-2026-65656

Microsoft Office Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office 2019 Office 2021 and 1 more
CVE-2026-56853

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Go Standard Library
Products
Net/http
CVE-2026-56862

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Go Standard Library
Products
Crypto Tls
CVE-2026-68792

Microsoft Office Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office 2019 Office 2021 and 1 more
CVE-2026-70464

rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Rsync Project Samba
Products
Rsync Rsync
CVE-2026-70453

rsync < 3.5.0 Algorithmic Complexity DoS via hash_search()

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Rsync Project Samba
Products
Rsync Rsync
CVE-2026-67323

GitPython before 3.1.51 Command Injection via unguarded Git options

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.

CVSS 4.0 · 8.6 High EPSS 1.3% KEV · Not listed
Vendors
Gitpython-developers Gitpython Project
Products
Gitpython Gitpython
CVE-2020-36950

Laravel Nova 3.7.0 - 'range' DoS

Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Laravel
Products
Laravel Laravel Nova
CVE-2026-19830

TRENDnet TEW-816DRM bftpd bftpd.conf allocation of resources

A vulnerability was found in TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN. This impacts an unknown function of the file /etc/bftpd.conf of the component bftpd. The manipulation of the argument USERLIMIT_GLOBAL results in allocation of resources. It is possible to launch the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Trendnet
Products
Tew-816drm
CVE-2026-19747

Tenda CH7 ATE Module Kylin HandleCmd command injection

A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely.

CVSS 4.0 · 9.3 Critical EPSS 3.1% KEV · Not listed
Vendors
Tenda
Products
Ch10 Ch7 Ch7g and 7 more
CVE-2026-23490

pyasn1 has a DoS vulnerability in decoder

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Debian Pyasn1
Products
Debian Linux Pyasn1