Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,295

Export CSV
CVE-2026-82379

Apache Roller: WSSE digest authentication headers can be replayed

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations that enable the non-default AtomPub API with WSSE authentication and plaintext-compatible password storage are affected. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes WSSE as an AtomPub authentication method; existing installations configured for WSSE fail closed until an administrator explicitly selects a supported authentication method.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Roller
CVE-2026-73251

Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification

Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tls_builtin.c, the mg_tls_init() function stores the bundle in tls->ca_bundle_der while tls->ca_der.len remains zero, and mg_tls_recv_cert() uses tls_bundle_find() to accept a Common Name match without calling mg_tls_verify_cert_signature(). A forged self-signed certificate can therefore satisfy hostname and CertificateVerify checks and enable interception, credential disclosure, traffic modification, and malicious responses. This issue is fixed in version 7.23.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Cesanta
Products
Mongoose
CVE-2026-93511

Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass

The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Premium Packages
CVE-2026-63374

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Agronholm
Products
Anyio
CVE-2026-85525

Improper OCSP response validation in Snowflake drivers

Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and definitive verification failures were treated as transient. A man-in-the-middle attacker holding a revoked certificate and its private key for a Snowflake or stage hostname could cause the driver to establish a TLS session to the attacker-controlled endpoint anyway, allowing the attacker to read and modify data transmitted within that connection. Successful exploitation requires that on-path position and the corresponding private key, and impact is limited to data carried within the intercepted connection. The fix is available in Snowflake Connector for Python v4.7.3, Snowflake Go Driver v2.2.0, Snowflake JDBC Driver v4.3.4 (including the snowflake-jdbc-fips and snowflake-jdbc-thin), and Snowflake Node.js Driver v3.3.0. Users must manually upgrade.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Snowflake
Products
Snowflake Connector For Python Snowflake Go Driver Snowflake Jdbc Driver and 1 more
CVE-2026-100701

Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion

Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on the cache hit and overwrites the second transport's explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport to connect to the attacker's TLS virtual host and accept the attacker's certificate even with rejectUnauthorized: true, disclosing the victim's SMTP credentials. Fixed in 10.0.2.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Nodemailer
Products
Nodemailer
CVE-2026-83964

Adobe Connect | Improper Certificate Validation (CWE-295)

Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Adobe Connect Adobe Connect Android Mobile App Connect and 3 more
CVE-2026-100390

Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Zoraxy
Products
Zoraxy
CVE-2026-85511

Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Data Grid Jboss Enterprise Application Platform Jboss Enterprise Application Platform Expansion Pack and 3 more
CVE-2026-77903

Microsoft Dataverse Elevation of Privilege Vulnerability

Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Dataverse
CVE-2026-69843

Microsoft Fabric Elevation of Privilege Vulnerability

Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Fabric Microsoft Fabric
CVE-2026-77967

Botslab G980H Dashcams Authentication Bypass by Capture-replay

The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another client to establish an authenticated session and access privileged device functionality.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Botslab
Products
G980h
CVE-2026-77707

TLS Certificate Validation Disabled for Keycloak Connections in HAVELSAN's Liman Render Engine

Improper certificate validation vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM). This issue affects Liman Render Engine: from 1.0 before 1.2-75.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Havelsan
Products
Liman Render Engine
CVE-2026-75907

CVE-2026-75907

The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on the UID of the NTAG212 NFC chip alone is identification, not authentication, and the credential has no challenge-response capability that would resist copying.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Norwegian Cruise Line
Products
Door Access Control
CVE-2026-82157

Improper Certificate Validation in Dell ThinOS 10 Allows Unauthorized Access

Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Protection mechanism bypass and Unauthorized access.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Thinos
CVE-2026-73587

Improper Certificate Validation in Dell Secure Connect Gateway Policy Manager

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Protection mechanism bypass.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Policy Manager For Secure Connect Gateway Secure Connect Gateway Policy Manager
CVE-2026-91166

Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Warp-tech
Products
Warpgate
CVE-2026-45720

Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The attacker can invoke SAML-protected gRPC endpoints, use ConfirmPublicKey to create multiple persistent credentials tied to the victim, and generate audit entries attributed to the victim, with the resulting access potentially affecting confidentiality, integrity, and availability according to the victim's privileges. This issue is fixed in versions 1.6.6 and 1.7.3.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Siderolabs
Products
Omni
CVE-2026-41707

Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs. This issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Security Spring Security