Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,740

Export CSV
CVE-2026-113597

Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Blinko Blinkospace
Products
Blinko Blinko
CVE-2026-113396

DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection

A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Draytek
Products
Vigor2960 Vigor2960 Firmware
CVE-2026-113388

opensource-socialnetwork Cache Settings dynamic.php input code injection

A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Opensource-socialnetwork
Products
Opensource-socialnetwork
CVE-2026-113382

arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload

A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the component Plugin Installer. Such manipulation of the argument plugin_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.1 can resolve this issue. The name of the patch is 04573681420295f7b327c9da3b101aed2f3cf432. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Arizu-id
Products
Fast-tunnel
CVE-2026-112785

OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Opencats
Products
Opencats
CVE-2026-112782

Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service

Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Getgrav
Products
Grav
CVE-2026-112777

Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Cms Craft Cms
CVE-2026-112772

Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Cms Craft Cms
CVE-2026-112372

H3C Magic NX15 upload importprofile path traversal

A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
H3c
Products
Magic Nx15 Magic Nx15 Firmware
CVE-2026-112360

Netis EAP930 CGI Endpoint debug return200 backdoor

A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Netis
Products
Eap930
CVE-2026-112300

DiffSK configobj __init__.py _sectionmarker redos

A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Diffsk
Products
Configobj
CVE-2026-112247

Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting

A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This affects an unknown function of the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx of the component Upload Endpoint. Executing a manipulation of the argument NewFile can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wuxi Wubang Security Software
Products
Five-in-one Safety Production Management Information System
CVE-2026-112159

JumpServer Template Rendering os command injection

A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 5.0.0 is sufficient to fix this issue. The identifier of the patch is fcf2904cdb884230e9676f50f37a44d09fa97040. The affected component should be upgraded. The vendor confirms: "This issue was identified quite some time ago, and we have already fixed it in the v5 branch. (...) The fix will also be included in an upcoming v4 release.

CVSS 4.0 · 5.1 Medium EPSS 1.0% KEV · Not listed
Vendors
Jumpserver
Products
Jumpserver
CVE-2026-111757

Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hono
Products
Hono
CVE-2026-111066

AIOHTTP: File descriptor exhaustion in multipart requests

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Aio-libs
Products
Aiohttp
CVE-2026-105453

IBM Sterling Connect:Direct for Unix Improper Privilege Management

IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Sterling Connect Direct
CVE-2026-101304

Multiple jail filesystem root escapes

When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Freebsd
Products
Freebsd
CVE-2025-36069

TS4500 Tape Library Insufficient Session Expiration

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Storage Ts4500 Library
CVE-2026-113353

LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Thimpress Wordpress-extensions
Products
Learnpress Learnpress