Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,783

Export CSV
CVE-2023-7250

Iperf3: possible denial of service

A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Es Redhat
Products
Iperf3 Enterprise Linux Enterprise Linux For Arm 64 and 3 more
CVE-2026-121373

Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)

The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content attributes of meta tags using a regular expression that is too narrow, allowing sanitization to be bypassed, and resulting in potential URL redirection to untrusted sites in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The shared declarative refresh steps in the WHATWG HTML Standard require a broader approach: the separator after the time may be ASCII whitespace alone, with no ; or ,, and the url= keyword is optional. Directives the browser honours, but the regular expression misses are returned unchanged, so the attacker URL skips UrlSanitizer entirely and both allowLinkSchemes and allowLinkHosts are defeated for the refresh navigation. This is reachable under any configuration that allows meta with http-equiv and content, including the documented allowStaticElements() preset.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sensiolabs
Products
Symfony
CVE-2026-117530

Command Execution via Insufficient Allowlist Validation in JetBrains Junie CLI

In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Junie
CVE-2026-114729

roundcubemail: roundcubemail: Information disclosure via SVG SMIL remote content blocking bypass

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Roundcube
Products
Webmail
CVE-2026-121382

Netcore NBR100V2 auto_ac msg_aes_dec integer overflow

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Netcore
Products
Nbr100v2
CVE-2026-119675

mongorestore may bypass collection guards through a system.buckets prefix

MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Database Tools
CVE-2026-118662

Vite: `server.fs.deny` bypassed with queries

Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Vitejs
Products
Vite
CVE-2026-117570

nmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilities

Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos, brute, or intrusive to nmap --script, running intrusive, brute-force, exploit, or denial-of-service scripts against scan targets.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Vorota-ai
Products
Nmap-mcp
CVE-2026-115845

Incomplete validation in the run_script Python sandbox in AWS MCP Server

An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script. AWS fixed this issue service-side. No customer action is required.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Aws-mcp-server Aws Mcp Server
CVE-2026-114653

Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder

A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the stored data — without possession of the encryption keys — can observe the unprotected values.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C# Driver
CVE-2026-114622

baserCMS: Encoded path traversal bypass in the theme file API

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update() and getFullpath(), but ThemeFileForm::_execute() subsequently applies rawurldecode() to fullpath before writing. Because normalizePath() resolves only literal dot segments, percent-encoded traversal can pass the containment checks and become a path outside the theme directory at the write sink. An authenticated administrator can write PHP files into writable locations such as webroot and execute them, exceeding the intended theme-template editing boundary. The source also identifies the same check-before-decode ordering in ThemeFilesService::copy(), although that path was not dynamically verified. Exploitation requires the non-default plugin, an administrator session, and a same-origin Origin header; USE_CORE_ADMIN_API=false does not block session-authenticated requests. The Admin web form is not affected by this encoded-path tampering because FormProtection protects fullpath. This is a third bypass of the protections associated with CVE-2026-30940, using encoded traversal decoded after validation. This issue has been patched in versions 5.3.2 and 5.4.2.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Baserproject
Products
Basercms
CVE-2026-96196

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Edge Chromium Microsoft Edge (chromium-based)
CVE-2026-93186

cxl/mbox: Clamp mailbox output allocation to the payload size

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXL_MEM_SEND_COMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxl_mbox_cmd_ctor() calls kvzalloc(out.size). A large out.size drives a huge allocation, above INT_MAX it WARNs and taints, and with panic_on_warn=1 it panics. The transport __cxl_pci_mbox_send_cmd() already clamps the response copy to min(out.size, payload_size, device len), so the output buffer is never written beyond payload_size. Clamp the allocation to payload_size too, matching the RAW path.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2023-52561

arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved Adding a reserved memory region for the framebuffer memory (the splash memory region set up by the bootloader). It fixes a kernel panic (arm-smmu: Unhandled context fault at this particular memory region) reported on DB845c running v5.10.y.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-115751

mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked hostname to fetch content from operator-blocked hosts.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frontmcp
Products
Mcp-from-openapi
CVE-2026-114615

Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Authlib
Products
Authlib
CVE-2026-114728

roundcubemail: roundcubemail: Remote content blocking bypass via crafted CSS escape sequences

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for example \000075rl( or u\72 l(, were not recognized and remote content was loaded from an HTML message without the user's consent. Upstream fixed this in the commit “Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)”, which resolves CSS escapes before matching and also inspects the `to`, `from` and `by` attributes.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Roundcube
Products
Webmail
CVE-2026-67615

openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass the class-name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject, causing the inner stream to be deserialized by a separate ObjectInputStream that does not apply the denylist, ultimately reaching a JNDI sink and enabling code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Apereo Foundation
Products
Openequella
CVE-2026-93630

Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before browser URL canonicalization. A percent-encoded hostname can therefore survive sanitization while the browser submits the form to the normal Zimbra origin with the recipient's authentication cookie. This permits authenticated form requests from a crafted email after the recipient opens it in Classic and submits the form. The issue is present in ZCS 10.1.16 and 10.1.21. It does not bypass an endpoint's CSRF-token checks; a state-changing attack additionally requires an endpoint that accepts the resulting request without that protection.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zimbra
Products
Zimbra Collaboration Suite