Export limit exceeded: 425871 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 11764 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,871

Export CSV
CVE-2024-34319

SSRF via Unvalidated serviceURL Parameter in ProPhoenix Law RMS

A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-34320

Incorrect Access Control in ProPhoenix Law RMS API Endpoints

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-34324

Session Hijacking via Crafted ASP.NET_SessionId Cookie in ProPhoenix Law RMS

An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-95124

Buffer Overflow in libconfini Leading to Remote Denial of Service

Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache()

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Madmurphy
Products
Libconfini
CVE-2026-78799

Directory Traversal in iKuai Wi-Fi 6 Routers Enables Remote Code Execution

Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
—
Products
—
CVE-2026-77093

CvFWD Denial of Service

CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-10813

LMCache KV Cache utils.py hex_hash_to_int16 weak hash

A flaw has been found in LMCache up to 0.5.4. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cache Handler. Executing a manipulation can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. Upgrading to version 0.5.5 is able to mitigate this issue. This patch is called ce08eea76ce5898200efee55f4932fd07a7cabeb. It is suggested to upgrade the affected component. A contributor of the project confirms: "hex_hash_to_int16() was introduced in 0.3.1 (PR #882, commit f5174701). It is not present in 0.3.0, and it is still present in 0.4.7 through 0.5.4."

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Lmcache
Products
Lmcache
CVE-2026-104585

Command Injection Vulnerability in Mobile Security Framework (MobSF) v4.5.2

Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
—
Products
—
CVE-2026-103417

Saved credentials can be autofilled after cross-origin navigation

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox For Ios
CVE-2026-109725

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox
CVE-2026-77096

CVFS Missing Authentication

CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-107350

Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Pgbouncer
Products
Pgbouncer
CVE-2026-109726

Use-after-free in the SVG component

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-109711

Use-after-free in the Graphics: Canvas2D component

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-109714

Incorrect boundary conditions in the Layout component

Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox