Search vulnerabilities

You must be logged in to use the 'userTag' filter.
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,892

Export CSV
CVE-2026-59276

Timing Attack via Non-Constant-Time Comparison of Sensitive Values

Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Security Spring Security
CVE-2026-73726

Authentication Bypass in HPE Networking Fabric Composer allows Unauthorized Administrative Access

A vulnerability has been identified in the underlying operating system of HPE Networking Fabric Composer that could potentially allow an unauthenticated adjacent actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Fabric Composer Fabric Composer
CVE-2026-73744

Authenticated Denial of Service Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface

A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Fabric Composer Fabric Composer
CVE-2026-73746

Authenticated Denial of Service Vulnerability in HPE Networking Fabric Composer API

A denial-of-service vulnerability exists in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Fabric Composer Fabric Composer
CVE-2026-73747

Local Privilege Escalation Vulnerability in HPE Networking Fabric Composer

A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user with local access to elevate their user privileges and make limited modifications on the affected system.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Fabric Composer Fabric Composer
CVE-2026-73748

Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer

A vulnerability in the affected interface of HPE Networking Fabric Composer allows an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Fabric Composer.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Fabric Composer Fabric Composer
CVE-2026-76657

Authentication Bypass in HPE Networking Fabric Composer API allows Administrative Access

Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Fabric Composer Fabric Composer
CVE-2026-76658

Unauthenticated Remote Code Execution in HPE Networking Fabric Composer SSH Daemon

A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Fabric Composer Fabric Composer
CVE-2026-63435

Mail: Email address spoofing via malformed RFC 2047 encoded-words

Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mikel
Products
Mail
CVE-2026-71981

Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload through this parameter, which is decoded and passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exploitation to achieve remote code execution as the web server process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Cypht-org
Products
Cypht
CVE-2026-84373

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Vitest.dev
Products
Mocker Vitest
CVE-2024-35585

Authentication bypass based on client source IP in MinKNOW

Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Oxford Nanopore
Products
Minknow
CVE-2026-84700

Pika Unauthenticated Replication Access via Internal Protobuf Port

PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g. 11221 when the default client port 9221 is used) that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as masterauth inside its MetaSync request — only the MetaSync handler (HandleMetaSyncRequest) validates it; the frame dispatcher (DealMessage) does not require a completed or attempted MetaSync before routing other message types to their handlers. As a result, an unauthenticated remote attacker can connect directly to the replication port and issue TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests, obtaining the full-sync snapshot and live write stream and removing replica nodes, even when requirepass is configured.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Openatomfoundation
Products
Pikiwidb
CVE-2026-84715

FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update

FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify their own permission records. A subuser with minimal permissions can send a crafted request to grant themselves full server control, enabling unauthorized access to sensitive data, backups, and server configuration.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Mythicalltd
Products
Featherpanel
CVE-2026-14357

DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary theme ZIP packages containing PHP files that are extracted into the web-accessible wp-content/themes/ directory, which may make remote code execution possible.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Dplugins Wordpress
Products
Devkit Pro Wordpress
CVE-2026-81770

WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mapgeo Wordpress
Products
Interactive Geo Maps Wordpress
CVE-2026-84118

Use-after-free in the JavaScript: GC component

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-84119

Sandbox escape due to use-after-free in the DOM: Navigation component

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird