Search vulnerabilities

Expected end of text, found '/' (at char 40), (line:1, col:41)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,864

Export CSV
CVE-2026-56946

Local Privilege Escalation in ARM SMMU v3 Driver

In smmu_unmap_visit_leaf of arm-smmu-v3.c, there is a possible way to release active direct memory access page references during unmapping due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-124742

Busybox: divide-by-zero in the volume_id fat prober via a zero sectors_per_cluster value

A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Red Hat Redhat
Products
Busybox Enterprise Linux Enterprise Linux and 3 more
CVE-2026-119830

Windows Storport Miniport Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Storport Miniport Driver allows an unauthorized attacker to elevate privileges with a physical attack.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more
CVE-2026-124969

Optimole <= 4.2.19 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via 'comment_content'/'comment_agent' Parameter during Attachment Rename

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the replace_urls_in_value function in all versions up to, and including, 4.2.19. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires PEAR's Archive_Tar library to be present and loadable on the host (common in official WordPress Docker images and many PHP distributions), and an administrator must subsequently use the plugin's Rename control on any attachment after the attacker has staged a malicious payload in a comment. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Optimole Wordpress-extensions
Products
Optimole Optimole
CVE-2026-119936

Windows Internet Information Services Denial of Service Vulnerability

Integer underflow (wrap or wraparound) in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more
CVE-2026-40275

Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety

Heap-based Buffer Overflow in the DCMD_PROC_EVENT handler of the procnto could allow an attacker with local access to cause an information disclosure, data tampering or a crash of the QNX Neutrino kernel.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Blackberry
Products
Qnx Os For Medical Qnx Os For Safety Qnx Software Development Platform
CVE-2026-56943

Android Attestation Out-of-Bounds Read Leading to Local Information Disclosure

In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android