Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,932

Export CSV
CVE-2026-6178

Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Muffingroup Wordpress
Products
Betheme Wordpress
CVE-2026-17583

Thermo Fisher Applied Biosystems Genetic Analyzers Missing Support for Integrity Check

The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Thermo Fisher Thermofisher
Products
Abi Prism 3100/3100-avant Data Collection Software Abi Prism 310 Data Collection Software Applied Biosystems 3130 Series Data Collection Software and 13 more
CVE-2026-5092

Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customapi action handler in versions up to, and including, 12.8.9. This is due to insufficient sanitization of API responses before output via innerHTML. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpsoul
Products
Wordpress Greenshift – Animation And Page Builder Blocks
CVE-2026-15916

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Drupal Core
CVE-2026-79792

zackees transcribe-anything Yt-dlp Download ytldp_download.py ytdlp_download os command injection

A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anything/ytldp_download.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Zackees
Products
Transcribe-anything
CVE-2026-79912

TOTOLINK N600R cstecgi.cgi getCurrentTime command injection

A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp_server results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.

CVSS 4.0 · 6.9 Medium EPSS 2.1% KEV · Not listed
Vendors
Totolink
Products
N600r N600r Firmware
CVE-2026-80182

keystone: keystone: Delegated token scope restrictions not consistently enforced across trust, OAuth1, and application credential endpoints

In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or authorize new delegations that persist independently of, and outlive, the credential used to obtain them. The delegation restrictions that block these operations did not consistently apply to all delegated token types, allowing an OAuth1-scoped token, for example, to create application credentials or authorize OAuth1 request tokens despite those operations being restricted for other delegated token types. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Openstack
Products
Keystone
CVE-2026-80184

keystone: keystone: Application credential tokens can escape project scope via token-method reauthentication

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential token was presented with no explicit scope, Keystone would issue a new token scoped to the credential owner's default project rather than the project for which the credential was issued, bypassing the intended project boundary. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Openstack
Products
Keystone
CVE-2026-7770

IBM i Access Client Solutions (ACS) is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator

IBM i Access Family 1.1.5.0 through 1.1.9.12 IBM i Access Client Solutions (ACS) is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I Access Client Solutions I Access Family
CVE-2026-79845

code-projects Simple Inventory System edit.php sql injection

A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of the file /InventoryManagement/edit.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Code-projects
Products
Simple Inventory System
CVE-2026-63403

Faktory: Unrecovered panic in command handlers allows full-server denial of service

Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vulnerable to an unauthenticated denial of service in which a single malformed command crashes the entire process. Its wire protocol is line-based, and several command handlers slice or index the received line at a fixed offset, such as cmd[5:] for PUSH or qs[0] for QUEUE, without checking that a payload is present. Sending a bare verb with no payload, for example PUSH, ACK, FAIL, BEAT, PUSHB, or QUEUE, triggers a Go slice or index out-of-range panic. Because the codebase has no recover() anywhere in the command-dispatch path, an unrecovered panic in a handler goroutine terminates the whole Go process rather than just that connection, instantly disconnecting every other client, worker, and in-flight job. The attack requires only a connection to the command port and completion of the trivial handshake, with no credentials when no password is configured, and can be repeated to keep the service down indefinitely. This issue is fixed in version 1.10.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Contribsys
Products
Faktory
CVE-2026-77554

Command Injection Vulnerability in UniFi Talk Allowing Remote Code Execution

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device.

CVSS 3.1 · 10 Critical EPSS 1.6% KEV · Not listed
Vendors
Ubiquiti
Products
Unifi Talk Application
CVE-2026-8058

This Power System update is being released to address a sensitive information disclosure

IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Openbmc Power System E1050 \(9043-mrx\) Power System E1050 \(9043-mrx\) Firmware and 28 more
CVE-2026-16554

Integer Overflow Leading to Heap Buffer Overflow in cJSON

cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service. Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Davegamble
Products
Cjson
CVE-2026-80191

GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests

GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries no session skips the check entirely and the handler returns the file. The routes reached this way, /attachment/:id and /download/:id, take the attachment identifier from the path, so an unauthenticated caller who has an attachment identifier receives the file regardless of whether the page owning it is private and regardless of whether that caller would be permitted to view the page. Identifiers can be retained by a user whose access was later removed, or recovered from anywhere the identifier was previously exposed. Version 8.0.2 runs the check for authenticated and unauthenticated requests alike, skipping it only where a valid share link has already bound the requested file to that link's page.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Growi Weseek
Products
Growi Growi
CVE-2026-34959

Adminer before 5.5.0 Open Redirect via X-Forwarded-Prefix

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL (e.g. X-Forwarded-Prefix: https://evil.example) that flows into Location redirect headers, the Set-Cookie path attribute, and self-referential links. This enables an authenticated open redirect after state-changing POSTs, unauthenticated control of the session cookie path attribute, and poisoning of self-referential links; CR/LF cannot be injected, so header splitting/XSS is not possible.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Adminer
Products
Adminer
CVE-2026-60849

High-Severity LDAP Exploit Enabling Directory Takeover in Oracle Unified Directory

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified Directory. While the vulnerability is in Oracle Unified Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Unified Directory. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Unified Directory
CVE-2026-80196

Kimai before 2.58.0 Authentication Bypass via Password Reset Link

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional times within a 1-hour window to log in as the user even after the legitimate user has changed their password.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Kimai
Products
Kimai