Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,831

Export CSV
CVE-2026-4270

AWS API MCP File Access Restriction Bypass

Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To remediate this issue, users should upgrade to version 1.3.9.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Amazon Aws
Products
Aws Api Mcp Server Aws Api Mcp Server
CVE-2026-7373

Metasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File Loading

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Rapid7
Products
Metasploit
CVE-2026-45772

Turborepo: Unexpected local code execution during Yarn Berry detection

Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands. This vulnerability is fixed in 2.9.14.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
@turbo Vercel
Products
Codemod Workspaces Turborepo
CVE-2020-37231

Privacy Drive 3.17.0 Unquoted Service Path Privilege Escalation

Privacy Drive 3.17.0 contains an unquoted service path vulnerability in the pdsvc.exe service binary that allows local attackers to escalate privileges by exploiting the service startup process. Attackers can place malicious executables in the unquoted path directories to execute arbitrary code with LocalSystem privileges during service startup or system reboot.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Cybertronsoft
Products
Privacy Drive
CVE-2020-37232

Advanced System Care Service 13.0.0.157 Unquoted Service Path Privilege Escalation

Advanced System Care Service 13.0.0.157 contains an unquoted service path vulnerability in the AdvancedSystemCareService13 service binary path that allows local attackers to escalate privileges. Attackers can place malicious executables in the system root path that will be executed with LocalSystem privileges during service startup or system reboot.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Iobit
Products
Advanced System Care
CVE-2026-32679

DLL Hijacking in LiveOn Meet and CanonNWCam Plugin Installers

The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the installers of Canon Network Camera Plugin (CanonNWCamPlugin.exe and CanonNWCamPluginForAdmin.exe) insecurely load Dynamic Link Libraries (DLLs). If a malicious DLL is placed at the same directory, the affected installer may load that DLL and execute its code with the privilege of the user invoking the installer.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Japan Media Systems Corporation Liveon
Products
Canonnwcamplugin.exe Canonnwcampluginforadmin.exe Downloader5installer.exe and 5 more
CVE-2024-36333

Privilege Escalation via DLL Hijacking in AMD Cleanup Utility

A DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Amd
Products
Amd Cleanup Utility Cleanup Utility Radeon Pro Vii and 26 more
CVE-2021-47974

VX Search 13.5.28 Unquoted Service Path Privilege Escalation

VX Search 13.5.28 contains an unquoted service path vulnerability in both VX Search Server and VX Search Enterprise services that allows local attackers to escalate privileges. Attackers can place malicious executables in unquoted path directories like C:\Program Files\VX Search to execute arbitrary code with LocalSystem privileges when services restart.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Vxsearch Webberzone
Products
Vx Search Better Search
CVE-2020-37230

Syncplify.me Server! 5.0.37 Unquoted Service Path Privilege Escalation

Syncplify.me Server! 5.0.37 contains an unquoted service path vulnerability in the SMWebRestServicev5 service that allows local attackers to escalate privileges by exploiting the unquoted binary path. Attackers can insert a malicious executable into the service path and execute it with LocalSystem privileges when the service restarts or the system reboots.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Syncplify
Products
Syncplify.me Server!
CVE-2020-37229

OKI sPSV Port Manager 1.0.41 Unquoted Service Path Privilege Escalation

OKI sPSV Port Manager 1.0.41 contains an unquoted service path vulnerability in the sPSVOpLclSrv service that allows local attackers to escalate privileges by inserting executable files into the unquoted path. Attackers can place a malicious executable in a directory within the service path that will execute with LocalSystem privileges when the service restarts or the system reboots.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Oki
Products
Oki Spsv Port Manager
CVE-2020-37247

Kite 4.2.0.1 U1 Unquoted Service Path Privilege Escalation

Kite 4.2.0.1 U1 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can place a malicious executable in the Program Files directory to be executed with LocalSystem privileges when the service starts.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Kite
Products
Kite
CVE-2026-42297

Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits. This issue has been patched in version 4.0.5.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Argoproj
Products
Argo-workflows Argo Workflows
CVE-2026-40004

openssl.cnf Privilege Escalation Vulnerability in ZTE Cloud PC Client uSmartview

There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code locally and escalate privileges.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Zte
Products
Zxcloud Irai
CVE-2026-0251

GlobalProtect App: Local Privilege Escalation Vulnerabilities

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Palo Alto Networks Paloaltonetworks
Products
Globalprotect App Globalprotect
CVE-2026-0237

Prisma Browser: Improperly Restricted Automation Bridge Allows Security Bypass

An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands to the browser, bypassing security controls.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Apple Palo Alto Networks Paloaltonetworks
Products
Macos Prisma Browser Prisma Browser
CVE-2026-40435

BIG-IP httpd access control vulnerability

When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2025-69599

Privilege Escalation via PATH Variable Manipulation in RayVentory Scan Engine

RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable. NOTE: this is disputed because ability of an attacker to control the environment is a site-specific misconfiguration.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Raynet
Products
Rayventory Scan Engine
CVE-2026-44612

Insecure DLL loading in Bytello Share Windows Installer enabling arbitrary code execution

Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user invoking the installer.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Bytello
Products
Bytello Share (windows Edition) Installer Executable