Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,863

Export CSV
CVE-2026-58247

Memory Corruption vulnerability in SAP ABAP Platform

SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data from previously used memory, leading to a low on confidentiality, with no impact on integrity and availability of the application.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Abap Platform
CVE-2026-58248

XML External Entity Injection in SAP BusinessObjects Business Intelligence

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sap Business Objects Business Intelligence Platform
CVE-2026-60053

Apache Answer: Residual Administrative API Key Access After Role or Account Revocation

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Answer
CVE-2026-63299

Storage volume cross-project move and snapshot restore bypass project disk limits

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Lxd
CVE-2026-63426

Local User Can Delete Files with Elevated Privileges in Lenovo Dock Manager

During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Dock Manager
CVE-2026-65546

WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Qode Wordpress
Products
Qode Tours Wordpress
CVE-2026-65551

WordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Soflyy Wordpress
Products
Breakdance Wordpress
CVE-2026-65565

WordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ays-pro Wordpress
Products
Survey Maker Wordpress
CVE-2026-65570

WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-65573

WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Abelle Wordpress
CVE-2026-65933

BT122 malformed packet with increased length field causes memory leak

A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs.com
Products
Bt122
CVE-2026-66274

Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Qpid Proton-j
CVE-2026-66275

Apache Qpid Proton-J: Incoming session flow control window can be exceeded

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Qpid Proton-j