Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 30,000

Export CSV
CVE-2023-5570

User Enumeration in Inohom's Home Manager Gateway

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting. This issue affects Home Manager Gateway: before v.1.27.12.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Inohom
Products
Home Manager Gateway
CVE-2026-34652

Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Commerce Commerce Commerce B2b and 1 more
CVE-2026-34654

Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Commerce Commerce Commerce B2b and 1 more
CVE-2022-24036

Unauthorized modification in Karmasis Informatics Infraskope SIEM+

Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificate logs.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Karmasis
Products
Infraskope Siem\+
CVE-2022-24038

Unauthorized modification in Karmasis Informatics Infraskope SIEM+

Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to damage the page where the agents are listed.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Karmasis
Products
Infraskope Siem\+
CVE-2022-24037

Unauthorized modification in Karmasis Informatics Infraskope SIEM+

Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to obtain critical information.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Karmasis
Products
Infraskope Siem\+
CVE-2026-43090

xfrm: fix refcount leak in xfrm_migrate_policy_find

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix refcount leak in xfrm_migrate_policy_find syzkaller reported a memory leak in xfrm_policy_alloc: BUG: memory leak unreferenced object 0xffff888114d79000 (size 1024): comm "syz.1.17", pid 931 ... xfrm_policy_alloc+0xb3/0x4b0 net/xfrm/xfrm_policy.c:432 The root cause is a double call to xfrm_pol_hold_rcu() in xfrm_migrate_policy_find(). The lookup function already returns a policy with held reference, making the second call redundant. Remove the redundant xfrm_pol_hold_rcu() call to fix the refcount imbalance and prevent the memory leak. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2022-36110

Netmaker vulnerable to Insufficient Granularity of Access Control

Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Netmaker
Products
Netmaker
CVE-2026-43343

usb: gadget: f_subset: Fix unbalanced refcnt in geth_free

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_subset: Fix unbalanced refcnt in geth_free geth_alloc() increments the reference count, but geth_free() fails to decrement it. This prevents the configuration of attributes via configfs after unlinking the function. Decrement the reference count in geth_free() to ensure proper cleanup.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2021-45478

IDOR in Yordam Library Automation System

Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users. This issue affects Library Automation System: before 19.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Yordam
Products
Library Automation System
CVE-2021-45477

IDOR in Yordam Library Automation System

Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users. This issue affects Library Automation System: before 19.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Yordam
Products
Library Automation System
CVE-2021-4105

Unauthenticated Remote Code Execution on COSLAT Firewall

Improper Handling of Parameters vulnerability in BG-TEK COSLAT Firewall allows Remote Code Inclusion. This issue affects COSLAT Firewall: from 5.24.0.R.20180630 before 5.24.0.R.20210727.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Bg-tek
Products
Coslat Bx5s1d3 Coslat Bx5s1d3 Firmware Coslat Bx5s1d4 and 13 more
CVE-2026-21016

Local Privilege Escalation via LocationManager on Samsung Android Firmware

Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Samsung Samsung Mobile
Products
Android Samsung Mobile Devices
CVE-2026-21022

Local Permissions Bypass in Samsung Mobile Routines Exposes Sensitive Data

Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Samsung Samsung Mobile
Products
Android Samsung Mobile Devices
CVE-2026-21020

Improper Export of OmaCP Application Components Enables Local Privilege Escalation

Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Samsung Samsung Mobile
Products
Android Samsung Mobile Devices
CVE-2026-43177

media: ipu6: Fix RPM reference leak in probe error paths

In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Fix RPM reference leak in probe error paths Several error paths in ipu6_pci_probe() were jumping directly to out_ipu6_bus_del_devices without releasing the runtime PM reference. Add pm_runtime_put_sync() before cleaning up other resources.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-43004

spi: stm32-ospi: Fix resource leak in remove() callback

In the Linux kernel, the following vulnerability has been resolved: spi: stm32-ospi: Fix resource leak in remove() callback The remove() callback returned early if pm_runtime_resume_and_get() failed, skipping the cleanup of spi controller and other resources. Remove the early return so cleanup completes regardless of PM resume result.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2024-37371

krb5: GSS message token handling

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

CVSS 3.1 · 9.1 Critical EPSS 1.9% KEV · Not listed
Vendors
Debian Mit Redhat
Products
Debian Linux Kerberos 5 Enterprise Linux and 6 more
CVE-2024-36959

pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel