Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,775

Export CSV
CVE-2026-11882

Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable overwrite requires the site to already be connected to a paid account.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Builderall For Wordpress
CVE-2026-12696

wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wpforo Forum
CVE-2026-13329

WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wc Buckaroo Bpe Gateway
CVE-2026-13596

Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Participants Database
CVE-2025-0604

Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak

A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Red Hat Single Sign On
CVE-2026-92091

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Enterprise Linux Openshift Ai and 2 more
CVE-2026-80179

Jwcrypto: jwcrypto: denial of service via malformed jwe tokens

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Openshift Ai (rhoai) Ansible Automation Platform Enterprise Linux and 3 more
CVE-2026-79655

Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Rhel Els
CVE-2026-18769

Insufficient IOCTL access control allows local relocation of arbitrary physical memory

A local low privileged attacker can move arbitrary physical memory content via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Beckhoff
Products
Tcrouter.sys Twincat.xar.base.km
CVE-2026-18768

Insufficient IOCTL access control allows local access to arbitrary physical memory

A local low privileged attacker can access arbitrary physical memory or define its mapping via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Beckhoff
Products
Tcrouter.sys Twincat.xar.base.km
CVE-2026-18767

Insufficient IOCTL access control allows local access to I/O ports

A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Beckhoff
Products
Tcrouter.sys Twincat.xar.base.km
CVE-2026-116468

Keycloak-services: keycloak-services: delegated admin escalates to realm-admin via group move

A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Red Hat Single Sign On
CVE-2026-12062

Authenticated SQL Injection

Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Zohocorp
Products
Adaudit Plus
CVE-2026-76981

Authenticated Second-Order SQL Injection

Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL injection vulnerability affecting ADAudit Plus custom reports module.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Zohocorp
Products
Adaudit Plus
CVE-2026-111190

ARForms <= 7.2.4 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header

The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin's file-type and content-safety checks can be evaded, allowing files that contain executable PHP code to be written to a publicly accessible directory. This makes it possible for unauthenticated attackers to upload malicious files to the affected site's server, which may make remote code execution possible. Exploitation requires a published form containing a File field to be publicly accessible on the site.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-121837

Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort

A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering and sorting operations. This allows an authenticated user to infer sensitive data values by observing which records match specific filter criteria or how they are ordered, even though the values are omitted from the final response.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Of Quarkus Exploit Intelligence Quarkus
CVE-2026-18912

Authenticated SQL injection

Zoho Corporation ManageEngine DataSecurity Plus versions below 6310 are vulnerable to an authenticated SQL injection vulnerability in reports module where an authenticated technician could execute arbitrary SQL queries.

CVSS 3.1 · 8.1 High EPSS 1.6% KEV · Not listed
Vendors
Zohocorp
Products
Datasecurity Plus Manageengine Datasecurity Plus
CVE-2026-89126

Memory Corruption vulnerability in SAP Web Dispatcher

SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-89017

Skyline DataMiner BrokerGateway Embedded API Key Authentication Bypass

Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthenticated attackers to retrieve the installation-specific BrokerGateway key even while pairing mode is disabled. Attackers can use the retrieved key to obtain the unrestricted DataMinerUser.creds NATS credential and gain trusted message-bus access via TCP port 4222 without any prior DataMiner credentials. Fixed in DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Skyline Communications
Products
Dataminer