Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,596

Export CSV
CVE-2026-84398

CareCam CM2507 Empty Password in Configuration File

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Carecam
Products
Hmt.cm2507 Firmware
CVE-2026-86749

snipe-it before 8.7.0 Data Loss via Failed Image Write

Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages(). Because Laravel's default disk mode does not throw on failure, a silently failed Storage::disk('public')->put(...) call still caused the application to delete the previous image via deleteExistingImage() and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirror problem existed in deleteExistingImage(), where a failed Storage::delete() still nulled the model's image field, orphaning the file on disk. The condition is not directly attacker-controlled: it is triggered when any legitimate authenticated user submits an image upload while the storage backend transiently fails (for example an S3 network error, a local filesystem permission problem, or quota exhaustion). The result is unrecoverable loss of the prior image and a durable inconsistency between the database and disk that requires manual reconciliation. All models whose controllers route through ImageUploadRequest::handleImages (assets, asset models, users, companies, manufacturers, locations, categories, suppliers, departments, and other image-carrying models) are affected.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Snipeitapp
Products
Snipe-it
CVE-2026-93158

crypto: sa2ul - stop probe if context pool creation fails

In the Linux kernel, the following vulnerability has been resolved: crypto: sa2ul - stop probe if context pool creation fails sa_ul_probe() calls sa_init_mem() to create the DMA pool used for security context buffers, but ignores its return value. If pool creation fails, probe still continues with DMA setup, algorithm registration and child population even though later request setup depends on that pool. Stop probing when sa_init_mem() fails, and route that failure to the PM cleanup path without attempting to destroy an uncreated DMA pool.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-2380

Security Advisory 0168

On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability. Examples of sensitive information include: - Sensitive CLI commands (e.g., "username bob secret myPass") - Sensitive OpenConfig YANG leafs (e.g., "system/aaa/global/tacacs/config/secret-key") This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Arista
Products
Eos
CVE-2026-86739

Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store(). On filesystem drivers that return false instead of throwing on a write failure (for example the local disk with restrictive permissions, S3 with expired credentials, or a storage backend that is out of quota), execution continues into $acceptance->accept(), which sets accepted_at and the signature_filename/eula_filename fields, creates the 'accepted' action-log entry, and dispatches completion notifications even though the evidence files were never stored. The result is an acceptance record marked complete whose supporting evidence files do not exist, yielding a materially incomplete compliance artifact for EULA acknowledgement or equipment-receipt workflows. The condition is triggered when an authenticated user completes an acceptance while the storage backend is silently failing writes; an attacker cannot directly force the storage backend into that state. Fixed in Snipe-IT 8.7.0.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Grokability Snipeitapp
Products
Snipe-it Snipe-it
CVE-2026-82783

Plaintext Password Storage Allows Credential Theft with Physical Access

Plaintext storage of a password issue exists in CONPROSYS nano Series . If this vulnerability is exploited, an attacker with physical access to the product may obtain credentials.

CVSS 4.0 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Contec
Products
Programmable Remote I/o Coupler Unit (software Plc Type) Cpsn-pcb271-s1-041 Remote I/o Coupler Unit (ethernet/ip Adapter) Cpsn-eob471ei-[]1 Remote I/o Coupler Unit (server Type) Cpsn-mcb271-*
CVE-2026-46488

motionEye: Authentication possible via password hash

motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meye_username and meye_password_hash cookies as authentication material without server-side session validation. An unauthenticated attacker who knows a target username and corresponding hash can set the cookies manually or cause them to be loaded by submitting blank credentials through the switch-user authentication flow, after which the server authenticates the attacker as that user. The administrator username and password-hash value are stored in /etc/motioneye/motion.conf, which is globally readable by default, allowing a local shell user to obtain reusable administrator credential material. Successful impersonation can enable account lockout, password changes and persistence, data enumeration, data destruction, and data exfiltration. This issue is fixed in version 0.44.0.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Motioneye Project
Products
Motioneye
CVE-2026-92828

service-ca-operator: Operator ServiceAccount bound to cluster-admin

No description is available for this CVE.

CVSS 3.1 · 9.0 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-19534

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Nodejs Undici
Products
Undici Undici
CVE-2026-77407

RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Rabbitmq
Products
Amqp091-go
CVE-2026-55225

Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster Operator to create a Role with full Secret CRUD permissions there and bind it to the Entity Operator ServiceAccount in the attacker's namespace. The attacker can mint a token for that ServiceAccount and read or write Secrets in any target namespace where the Cluster Operator has been granted permissions, regardless of STRIMZI_NAMESPACE. This issue is fixed in versions 1.0.1 and 1.1.0.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Strimzi
Products
Kafka-operator
CVE-2026-89444

platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer set_attribute() populates the security area of the BIOS attribute request buffer with the current admin password via populate_security_buffer(), then dumps the whole request buffer with print_hex_dump_bytes(). This can expose the plaintext admin password in the kernel log. The same issue was fixed for the password attribute path by commit d1a196e0a6dc ("platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data"). Remove the remaining dump from the BIOS attribute path.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2025-15679

BMC root account active without password on BullSequana XH3406 and XH3515

Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Bull
Products
Bullsequana Xh3406 Bullsequana Xh3515
CVE-2026-80238

Exploitable Exposed Docker Socket Allows Local Privilege Escalation in Dell Secure Connect Gateway 5.0

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. This vulnerability is considered critical because a low-privileged operator with SSH access to the SCG host can gain root-level access to the host without requiring a password by leveraging the exposed Docker socket. Additionally, an attacker who compromises a service running within the orchestrator container can access the same socket and escape the container boundary to obtain host-level control. Dell recommends that customers upgrade at the earliest opportunity.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Secure Connect Gateway Secure Connect Gateway Appliance Secure Connect Gateway Application
CVE-2026-89259

Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --allow-worker). As a result, the restrictions intended by the fix for GHSA-x597-9fr4-5857 could still be bypassed, allowing a Node tool invoked during a build to read and write files outside the project's working directory. Affected versions are those after v0.43; the issue was fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list. Users who do not use TailwindCSS, or who only build trusted sites, are not affected. As a workaround, users can define a restrictive security.exec.allow list in hugo.toml.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Gohugo
Products
Hugo
CVE-2026-86141

libxml2: libxml2: Denial of Service due to NULL pointer dereference in xmlRegNewParserCtxt

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2026-79942

Unauthorized Local Access via Unnecessary Privileges in Dell Secure Connect Gateway 5.0

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Secure Connect Gateway
CVE-2026-87506

WebUI Privilege Escalation in Google Chrome via Renderer Process

Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome