Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,604

Export CSV
CVE-2026-119597

OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Aidotnet
Products
Opendeepwiki
CVE-2026-112256

Logon bypass (trust of attacker-controlled completed-methods list)

Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Opentext
Products
Advanced Authentication Server
CVE-2026-111732

Out-of-bounds write when parsing AR Vendor Block requests

P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block length. A crafted Connect request causes an out-of-bounds write. This can lead to a crash (denial of service) or potentially arbitrary code execution. This option is disabled by default.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Rt-labs
Products
P-net
CVE-2026-122051

Edimax BR-6208AC mp command injection

A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 10 Critical EPSS 2.6% KEV · Not listed
Vendors
Edimax
Products
Br-6208ac Br-6208ac Firmware
CVE-2026-115828

Secret Server device validation error

In Secret Server on-prem versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Delinea
Products
Secret Server
CVE-2026-122220

WPO365 LOGIN before 45.2 SAML Replay Protection Bypass

WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-71457

vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php

vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Vtenext
Products
Vtenext
CVE-2026-121952

FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability

FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches in its Confirm Active, causing heap corruption, heap data leakage to the backend, or a crash.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-121953

FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close

FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-105420

Path Traversal in Wing WFTP Server leading to Remote Code Execution

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner privileges.Critically, since the installation guide mentions running the command with `sudo`, the files are created as “root.” This issue was fixed in version 8.2.6.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Wing Soft Technology
Products
Wing Ftp Server
CVE-2026-22058

CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)

StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Netapp
Products
Storagegrid
CVE-2026-115829

Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force

In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone.

CVSS 4.0 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Delinea
Products
Secret Server
CVE-2026-14571

SQL injection (SQLi) in the user authentication module of Futurum Software

A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided inputs in queries to the private area’s database, as well as by an incorrect WAF configuration. This weakness allows the protection mechanisms to be bypassed solely by sending manipulated HTTP requests. Successful exploitation of the vulnerability could allow an unauthenticated attacker to execute arbitrary queries against the database, extract its complete structure and gain access to sensitive customer information, including personally identifiable information (PII).

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Futurum Software
Products
Futurum Software User Authentication Module
CVE-2026-118633

Path‑Traversal Remote Code Execution Risk in Sophos SG UTM Email Proxy

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Sophos
Products
Sg Utm
CVE-2026-104383

Code injection in EagleCloud Aquila on-premises version

Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Eaglecloud
Products
Aquila
CVE-2026-120280

WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection

A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 10 Critical EPSS 2.0% KEV · Not listed
Vendors
Wavlink
Products
Wn536ax6-a
CVE-2026-120276

WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection

A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

CVSS 4.0 · 10 Critical EPSS 3.2% KEV · Not listed
Vendors
Wavlink
Products
Wn536ax6-a
CVE-2026-120229

WAVLINK WN553X1-B ioos sub_416B50 os command injection

A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 9.4 Critical EPSS 2.8% KEV · Not listed
Vendors
Wavlink
Products
Wn553x1-b
CVE-2026-120225

Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal

A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Oray
Products
Pugongying X5 Pro
CVE-2026-120195

WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection

A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlan_ssid leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 10 Critical EPSS 2.1% KEV · Not listed
Vendors
Wavlink
Products
Wl-wn579a3-a