Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,831

Export CSV
CVE-2026-53819

OpenClaw < 2026.5.27 - Arbitrary Homebrew Executable Execution via Workspace .env Override

OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to trusted operator workspaces can execute unintended Homebrew-compatible executables during skill setup to compromise the system.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-10847

Local Privilege Escalation vulnerability in Check Point Identity Agent Full for Windows OS

A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log collection process. Successful exploitation could allow an attacker to gain elevated privileges on the affected Windows endpoint.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Checkpoint
Products
Identity Agent
CVE-2026-0268

Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux

A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel. This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.

CVSS 4.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Palo Alto Networks Paloaltonetworks
Products
Linux Kernel Prisma Access Agent Prisma Access Agent
CVE-2026-8637

Uncontrolled Search Path Vulnerability in LanSchool Classic Enables Local Code Execution

A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authenticated user to execute arbitrary code with elevated privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Lanschool Classic
CVE-2026-24064

Local Privilege Escalation via Dynamic Library Injection in Waves Central for macOS

Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the product is signed with hardened runtime entitlements that permit dynamic library injection. A local attacker can set the DYLD_INSERT_LIBRARIES environment variable to inject an attacker-controlled dynamic library into the trusted client process at launch. The injected code runs within the signed process and can connect to the product's privileged helper service to invoke privileged operations, resulting in arbitrary code execution as root. The issue is fixed in version 16.6.2.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Waves Audio
Products
Waves Central
CVE-2026-36574

DLL Hijacking in CactusViewer Allowing Privilege Escalation

A DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2.3.0 allows attackers to escalate privileges and execute arbitrary code via a crafted DLL.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Wassimulator
Products
Cactusviewer
CVE-2026-11401

Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper. To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Aws Advanced Go Wrapper
CVE-2026-41567

Docker: `PUT /containers/{id}/archive` executes container binary on the host

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Moby
CVE-2026-50033

DLL Hijacking Vulnerability in Acronis DeviceLock DLP Enables Local Privilege Escalation

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

CVSS 3.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Acronis
Products
Acronis Devicelock Dlp
CVE-2026-44682

DLL Hijacking Leading to Local Privilege Escalation in Acronis DeviceLock DLP

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

CVSS 3.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Acronis
Products
Acronis Devicelock Dlp
CVE-2026-44609

Local Privilege Escalation via EXE Hijacking in Acronis DeviceLock DLP

Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

CVSS 3.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Acronis
Products
Acronis Devicelock Dlp
CVE-2025-14018

Unquoted Service Path in NetBT Consultancy's e-Fatura

Unquoted Search Path or Element vulnerability in NetBT Consulting Services Inc. E-Fatura allows Leveraging/Manipulating Configuration File Search Paths, Redirect Access to Libraries. This issue affects e-Fatura: before 1.2.15.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-44477

CloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then demotes the session with SET ROLE pg_monitor. SET ROLE changes only current_user; session_user remains postgres. Any SQL expression evaluated inside the scrape session can invoke RESET ROLE to recover real superuser privileges, then use COPY ... TO PROGRAM to spawn an OS-level subprocess as the postgres user inside the primary pod. The READ ONLY transaction flag does not block this; it gates writes to database state, not external processes. This vulnerability is fixed in 1.29.1 and 1.28.3.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Cloudnative-pg Linuxfoundation
Products
Cloudnative-pg Cloudnativepg
CVE-2026-3198

Improper Access Control in mlflow/mlflow

MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerability exposes sensitive information, such as API keys, endpoint configurations, and proprietary model definitions, to unauthorized users.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Lfprojects Mlflow
Products
Mlflow Mlflow/mlflow
CVE-2026-30906

Privilege Escalation via Untrusted Search Path in Zoom Rooms Installer

Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Zoom
Products
Rooms
CVE-2026-49299

openstack-neutron: OpenStack Neutron: Unauthorized tag modification due to policy enforcement mismatch

In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources. Deployments running Neutron 26.0.0 or later are affected.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack
Products
Neutron