Export limit exceeded: 425892 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 111,315

Export CSV
CVE-2026-82413

ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`)

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept scan_ports from any authenticated session, including non-administrator users, while deployments with login disabled expose the same request without authentication. The endpoints validate scan_ports with validateSingleWord, which permits shell metacharacters, and persist the value for the minute vulnerability-scan scheduler. The scheduler concatenates the value into an nmap command through nmap_scan_host and executes it through ntop.execCmd or ntop.execCmdAsync using popen. For the tcp_portscan and cve modules, a preliminary nmap -sn probe must first report the target as up before the attacker-controlled ports are used. When nmap is installed, this command injection allows arbitrary operating-system commands to execute as the ntopng service account without further user interaction. This issue is fixed in version 6.7.260717.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Ntop
Products
Ntopng
CVE-2026-76077

ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Esa
Products
Asn1scc
CVE-2026-70659

stable-diffusion.cpp: Heap out-of-bounds write in the imatrix loader (`load_imatrix`) via a duplicate tensor name

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. From master-742-1a13107 until master-763-4fcc6fe, IMatrixCollector::load_imatrix in src/runtime/imatrix.cpp reuses the values and counts vectors for entries with the same tensor name but resizes them only when they are empty. An untrusted .imatrix file can provide a small nval for the first entry and a larger nval for a second entry with the same name, causing the accumulation loop to write attacker-controlled floating-point and integer values beyond both heap buffers. Loading the file through the --imat-in conversion path can corrupt the heap or crash the process before a model is required. This issue is fixed in master-763-4fcc6fe.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Leejet
Products
Stable-diffusion.cpp
CVE-2026-61854

VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth

VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous `_cleanup_tenant()` operations for one tenant. Cleanup reads `transcripts.jsonl` and rewrites it in place without file locking or atomic replacement, while `report_buffer_append_async` uses `asyncio.to_thread` to append without synchronization. In `main.py`, concurrent `_processing_worker` tasks make this reachable in normal operation; `processing.worker_count` of two or more and public-pool servers sharing a `server_key` increase collisions. With `report_buffer.enabled` set to true, racing writes can lose, duplicate or corrupt transcript data and defeat `report_buffer.retention_seconds` pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Jackh54
Products
Voicesentinel
CVE-2026-55368

h2o: buffer overflow when using the %{error}x log directive

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was configured. The allocation errors affected %{error}x, %q when the query string was empty, and numeric elements whose temporary terminating NUL reached the end of the buffer. A matching request could crash the server, while the effect of the one-byte NUL overwrite beyond a crash was not established. This vulnerability is fixed with commit 48b7ae12107fd2b118e4641da49599e9aac8edd8.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
H2o
Products
H2o
CVE-2026-54382

VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access

VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being restricted to their own folder. Attackers can overwrite other users' objects in the shared S3 bucket using credentials obtained via CVE-2026-54378, destroying original content without triggering deletion protections.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Shenzhen Shine Industrial
Products
Vitafit
CVE-2026-54381

VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure

VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881 user-uploaded profile images, to access sensitive personal data without credentials.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Shenzhen Shine Industrial
Products
Vitafit
CVE-2026-54376

VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can capture the 30-day Fitbit authorization token with weight scope delivered in the callback URL to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Shenzhen Shine Industrial
Products
Vitafit
CVE-2026-54375

VitaFit Android < 2.8.1.0 Long-Lived Session Token Exposure

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted m_session_id tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to read and modify the victim's account or delete the account's authentication record, preventing the legitimate owner from logging in again.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Shenzhen Shine Industrial
Products
Vitafit
CVE-2026-54374

VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embedded WeChat, Tencent QQ, and Fitbit credentials from the decompiled application to abuse the active third-party application registrations.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Shenzhen Shine Industrial
Products
Vitafit
CVE-2026-54372

VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. Attackers can perform a man-in-the-middle attack to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Shenzhen Shine Industrial
Products
Vitafit
CVE-2026-54146

OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)

OpenHuman is an open-source agent harness available as a desktop application and Rust library. From 0.53.15 before 0.57.5 on macOS, core_process.rs in the Tauri desktop process publishes the per-launch OPENHUMAN_CORE_TOKEN bearer credential in its process environment even though the core now runs as an in-process task. Another process running as the same user can read that environment through the macOS KERN_PROCARGS2 process-inspection interface, recover the token together with the local host and port, and authenticate to the core JSON-RPC service with the authority of the desktop frontend. The attacker can read agent memory and integrated-account data, invoke privileged actions, change configuration, and stop or disrupt services without root access, developer mode, or changes to System Integrity Protection. This issue affects Intel and Apple Silicon macOS systems. This issue is fixed in version 0.57.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Tinyhumansai
Products
Openhuman
CVE-2026-54145

OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)

OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs, and RPC responses, including during normal desktop operation. An attacker who obtains these artifacts can recover the token and access the core RPC interface while it remains valid. This can expose sensitive agent and integration data and permit privileged operations. Stable tokens remain usable until rotated; launch-specific tokens remain usable while the corresponding core instance is active. The fix is included in version 0.57.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Tinyhumansai
Products
Openhuman
CVE-2026-123095

mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files or loading shared objects via ladspa for code execution.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Mpv
Products
Mpv
CVE-2026-122329

SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoder

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder_aiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing crashes or potential code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Libsdl-org
Products
Sdl Mixer
CVE-2026-122328

SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Libsdl-org
Products
Sdl Mixer
CVE-2026-122308

Kyverno before 1.19.2 Label Spoofing via Generation Handler processRequest

Kyverno before 1.19.2 contains an authorization bypass vulnerability in the Generation Handler that allows users with create/update permissions to trigger synchronized generate policies by spoofing internal generate.kyverno.io labels. Attackers can label a ConfigMap as managed-by kyverno with crafted policy, rule, and trigger labels to clone sensitive Secrets from restricted namespaces into their own namespace.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2026-122307

Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling

Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpolicygenerator controller, which folds PolicyExceptions into generated ValidatingAdmissionPolicies while ignoring the --enablePolicyException, --exceptionNamespace, and policy kind gates. Users with namespaced create rights on PolicyExceptions can inject negated matchConditions into the generated policies to admit violating resources, bypassing cluster-wide enforcement.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2026-122306

Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching

Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict, pinning cores and causing cluster-wide webhook timeouts that block resource operations.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2026-122305

Kyverno before 1.19.2 Denial of Service via Nested Variable Substitution Loop

Kyverno before 1.19.2 contains a denial of service vulnerability in substituteVariablesIfAny that allows low-privileged users to hang the admission webhook via self-referential variable templates. Attackers can create resources whose annotations re-introduce the embedded policy variable, causing unbounded substitution loops that exhaust CPU and memory and block cluster-wide admission.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno