Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,295

Export CSV
CVE-2026-112816

Improper certificate validation in the HTTPS listener in LXD

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Lxd
CVE-2026-93291

Improper certificate validation in Eufy Omni C20

Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Eufy
Products
Omni C20
CVE-2026-119425

OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Opnsense
Products
Core Opnsense
CVE-2026-113812

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available. An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server. LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA. Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-111943

Distrust compromised intermediate certificates in crypto/x509

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Go Standard Library Redhat
Products
Crypto/x509 Enterprise Linux Hummingbird
CVE-2026-87865

knownhost callback mismatches key as missing

When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Curl
Products
Curl
CVE-2026-86410

redirect to SFTP or SCP bypasses host verification

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Curl Redhat
Products
Curl Hummingbird
CVE-2026-55202

Tinyproxy - Stathost Detection Bypass via Host Header Manipulation

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Tinyproxy Tinyproxy Project
Products
Tinyproxy Tinyproxy
CVE-2026-119118

Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags

Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read cookies and headers sent, while hard-coded --no-sandbox also overrides CRAWL4AI_CHROMIUM_SANDBOX.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Unclecode
Products
Crawl4ai
CVE-2026-118687

Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Coder
Products
Coder
CVE-2026-118651

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo's forwarded identity. This issue is fixed in Echo 5.4.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Labstack
Products
Echo
CVE-2026-116201

Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Snipeitapp
Products
Snipe-it
CVE-2026-87866

wolfSSL public-key pinning bypass

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Curl
Products
Curl
CVE-2026-103314

Stackrox: stackrox: saml response replay allows multiple central authentication tokens

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Advanced Cluster Security
CVE-2026-116641

The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs

The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check. The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Database Tools
CVE-2026-117611

Trust of compromised eMudhra root CA in bundled CA stores

Improper certificate validation in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL): the Certificate Authority stores bundled with "certifi" and "webpki-roots" include a root CA that trusts eMudhra (emSign) intermediate certificates whose private keys are public.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2026-114617

Authlib: ID token can disable its own nonce validation via the nonce_supported claim

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token() reads the nonce_supported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid relying parties, or applications that directly accept externally supplied ID tokens, an attacker with a captured validly signed token can bypass the nonce-to-session binding and replay the victim's token into an attacker-controlled session. Plain authorization code flow is not affected, and the token must still pass signature, issuer, and audience validation. OpenIDMixin.parse_id_token() trusts nonce_supported in both authlib/integrations/base_client/sync_openid.py and authlib/integrations/base_client/async_openid.py to disable the expected nonce. This issue is fixed in version 1.9.0.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Authlib
Products
Authlib
CVE-2026-115962

WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability

Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-115369

OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs

OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Openbao
Products
Openbao