Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,604

Export CSV
CVE-2026-101108

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate anonymous-reachable frontend entry points (category listing, search, and the all-vehicles listing) through a sanitizing function that applies real escaping, but the value is then placed into an unquoted ORDER BY clause, where escaping has no protective effect.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Ordasoft Ordasoft.com
Products
Vehicle Manager Vehicle Manager (free) Extension For Joomla
CVE-2016-20101

Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php

Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-85614

OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue requests to internal services, localhost, and cloud metadata endpoints, reading internal HTTP response titles, headers, status codes, and SSL certificate information.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Openpanel
Products
Openpanel
CVE-2026-75143

FFmpeg Heap Buffer Overflow via RIST Protocol Reader

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-115727

AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server

AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Fosowl
Products
Agenticseek
CVE-2026-112296

FlyCms through commit edfdf724 Default Super Administrator Credentials

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Flycms Project Sunkaifei
Products
Flycms Flycms
CVE-2026-109391

Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API

Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Square Squash
Products
Squash Square Squash
CVE-2026-105223

maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer tokens or Basic credentials and tamper with WebSocket or REST API traffic.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Maclof Redhat
Products
Kubernetes-client Kubernetes-client
CVE-2026-105222

alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests, steal the API key from the query string, and tamper with responses.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Alexpechkarev Bestwebsoft
Products
Google-maps Google Maps
CVE-2026-105216

go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper

go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Micro Micro-ecc Project
Products
Go-micro Micro-ecc
CVE-2020-37281

Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Management
CVE-2018-25254

NICO-FTP 3.0.1.19 Buffer Overflow SEH

NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending crafted FTP commands. Attackers can connect to the FTP service and send oversized data in response handlers to overwrite SEH pointers and redirect execution to injected shellcode.

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed
Vendors
Nico-ftp Nico-ftp Project
Products
Nico-ftp Nico-ftp
CVE-2026-89309

Missing Authentication Vulnerability in JTL-WMS

The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method including GET and HEAD, a request carrying a malformed or non-bearer Authorization header is passed through without a valid token being required. The middleware does validate a token whenever a well-formed one is present, but in these two cases it does not require one. A remote attacker with network access to the service can therefore invoke API functionality without valid credentials.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Jtl-software
Products
Jtl-wms
CVE-2026-49950

Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool

Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Xorbitsai
Products
Xoscar
CVE-2026-89310

SQL Command Injection Vulnerability in JTL-WMS

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Jtl-software
Products
Jtl-wms
CVE-2026-110612

vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil

vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Wwwlike
Products
Vlife
CVE-2026-110616

NullHub through 2026.5.29 Missing Authentication for /api Management API

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Nullclaw
Products
Nullhub
CVE-2026-110632

Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE

Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Report One
Products
Myreport Updater
CVE-2026-110634

git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.

CVSS 4.0 · 9.3 Critical EPSS 2.3% KEV · Not listed
Vendors
Danday74 Git-diff-apply Project
Products
Git-diff Git-diff-apply
CVE-2026-110645

Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.

CVSS 4.0 · 9.3 Critical EPSS 3.2% KEV · Not listed
Vendors
Arsalandotme
Products
Video-stitch