Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,310

Export CSV
CVE-2026-87947

SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145

Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Saml Sso - Service Provider
CVE-2026-114437

Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For

In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Go-chi
Products
Chi
CVE-2026-105256

LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter

The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Latepoint
CVE-2026-114050

vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Vllm Vllm-project
Products
Vllm Vllm
CVE-2026-65197

H3C G3/G5 HDM Firmware Verification Key Replacement

H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after validating only that the multipart filename ends in `.pem`. An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key.  This was observed on H3C HDM Family-A G5 HDM 6.14.01. H3C HDM Family-A G3/G5 builds carrying the Redfish/DRE update tree appear to be affected. HDM2 uses a different update path and is not covered by this finding.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
H3c
Products
Hdm Family-a G5
CVE-2026-111883

Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swarms and wiping recorded performance results.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Locust
Products
Locust
CVE-2026-108372

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to `GET /status.json`, `GET /review-material?goal_id=...&path=...`, `GET /`, and `POST /control-plane/configure-goal/dry-run`, exposing control-plane state, goal and run information, local absolute paths, private Markdown files below registered goal roots, and dry-run configuration projections. The affected routes do not provide cross-origin writes or arbitrary-file access. This issue is fixed in version 0.4.5.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Huangruiteng
Products
Loopx
CVE-2026-110726

Default Rate‑Limit Key Resolver Allows Unlimited Bypass via X‑Forwarded‑For Manipulation

In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Connected Services Platform
CVE-2026-104642

Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-112939

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Tox-dev
Products
Filelock
CVE-2026-16487

bootc: containers-common: bootc: automatic updates can apply unsigned mutable-tag content under default containers policy

Red Hat Product Security has determined that this is not a vulnerability in bootc or containers-common. bootc fetches images under /etc/containers/policy.json. The shipped default is insecureAcceptAnything for registries without an explicit signature requirement; registry.redhat.io and registry.access.redhat.com require signatures. Updating a mutable tag requires the ability to publish to the reference an administrator has already configured the host to follow. Requiring signatures is available through that policy and through bootc enforce-container-sigpolicy, which is off by default. Persistence of /var across bootc rollback is expected image-mode behavior.

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed
Vendors
Bootc Redhat
Products
Bootc Enterprise Linux Hardened Images and 1 more
CVE-2026-103311

Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared Secret

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowing unauthenticated attackers to forge notifications that mark arbitrary orders as paid or cancel already-paid orders.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Coinbase Commerce Payment Gateway For Woocommerce
CVE-2026-86791

iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Forgery

The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Ipos Pays Payment Gateway For Woocommerce
CVE-2026-112377

CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Ccc-attestation
Products
Attested-tls-poc
CVE-2026-64024

tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction

In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is violated by multiple drop paths between the producer (__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer (tcp_conn_request()): - min_ttl / min_hopcount check - xfrm policy check - tcp_inbound_hash() MD5/AO mismatch - tcp_filter() eBPF/SO_ATTACH_FILTER drop - th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv() - tcp_checksum_complete() in tcp_v{4,6}_do_rcv() - tcp_v{4,6}_cookie_check() returning NULL When a packet is dropped on any of these paths, tcp_tw_isn is left set. The next SYN processed on the same CPU then consumes the non zero value in tcp_conn_request(), receiving a potentially predictable ISN. This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu variable. Note that tcp_v{4,6}_fill_cb() do not set it. Very litle impact on overall code size/complexity: $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7) Function old new delta tcp_v6_rcv 3038 3042 +4 tcp_v4_rcv 3035 3039 +4 tcp_conn_request 2938 2923 -15 Total: Before=24436060, After=24436053, chg -0.00%

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-104641

Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-103301

Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret

The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as paid. The same handler also marks an attacker-chosen order as failed when given an invalid signature.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-74922

Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Document Gallery
CVE-2026-113620

Eclipse ioFog operator WebSocket accepts an unverified JWT

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Eclipse Iofog