Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,607

Export CSV
CVE-2026-97160

Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVSS 4.0 · 9.4 Critical EPSS 1.3% KEV · Not listed
Vendors
Lomart Lomart.fr
Products
Up Up Plugin For Joomla
CVE-2026-97161

Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Lomart Lomart.fr
Products
Up Up Plugin For Joomla
CVE-2026-93475

Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509

The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification. It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Threadx Netx Duo
CVE-2026-97163

Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Lomart Lomart.fr
Products
Up Up Plugin For Joomla
CVE-2026-113389

DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection

A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 9.4 Critical EPSS 1.9% KEV · Not listed
Vendors
Draytek
Products
Vigor2960 Vigor2960 Firmware
CVE-2026-113391

DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection

A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 9.4 Critical EPSS 2.1% KEV · Not listed
Vendors
Draytek
Products
Vigor2960 Vigor2960 Firmware
CVE-2026-102469

Eclipse Vert.x DB2 Client Deserializes Untrusted Data Enabling Remote Code Execution

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call with no ObjectInputFilter or class allowlist. This code path is triggered when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50). However, DB2 does not support this type of UDT. The FDOCA 0x50 type is never sent by a legitimate DB2 server. Nevertheless, a malicious or man-in-the-middle DRDA server could craft a response with a 0x50-tagged column, causing the client to deserialize arbitrary attacker-controlled bytes on the Vert.x event loop before any application code can inspect or reject the data. If a Java deserialization gadget chain is present on the application's classpath, this enables remote code execution. Without a gadget chain, denial of service is possible via crafted object graphs. TLS is disabled by default, making man-in-the-middle exploitation feasible. The impacted component is io.vertx:vertx-db2-client.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Vert.x
CVE-2026-113506

aaPanel File Manager common.py ExecShell os command injection

A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."

CVSS 4.0 · 9.4 Critical EPSS 2.1% KEV · Not listed
Vendors
Aapanel
Products
Aapanel
CVE-2026-109588

Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel

Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call. To remediate this issue, users should upgrade to version V11.3.2 or later.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Freertos
Products
Freertos-kernel
CVE-2026-35560

Improper certificate validation in identity provider connection components in Amazon Athena ODBC driver

Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default transport security when connecting to identity providers. This only applies to connections with external identity providers and does not apply to connections with Athena. To remediate this issue, users should upgrade to version 2.1.0.0.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Amazon Apple Linux and 1 more
Products
Amazon Athena Odbc Driver Athena Odbc Macos and 2 more
CVE-2026-35561

Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver

Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to intercept or hijack authentication sessions due to insufficient protections in the browser-based authentication flows. To remediate this issue, users should upgrade to version 2.1.0.0.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Amazon Apple Linux and 1 more
Products
Amazon Athena Odbc Driver Athena Odbc Macos and 2 more
CVE-2026-8178

Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver

An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath. To mitigate this issue, users should upgrade to version 2.2.2 or later.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Amazon Aws
Products
Amazon Redshift Jdbc Driver Amazon-redshift-jdbc-driver
CVE-2026-77936

Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access

Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Letta
Products
Letta
CVE-2026-113703

SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Giuseppe99barchetta
Products
Suggestarr
CVE-2026-43844

Authentication Bypass in the Proprietary Protocol of Advantech ADAM-3600

A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Adam-3600
CVE-2026-112776

Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Craft Cms
CVE-2026-109587

Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel

Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call. To remediate this issue, users should upgrade to version V11.3.2 or later.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Freertos
Products
Freertos-kernel
CVE-2026-75128

Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint

Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).

CVSS 4.0 · 9.3 Critical EPSS 2.2% KEV · Not listed
Vendors
Chatchat-space
Products
Langchain-chatchat
CVE-2026-112779

Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass

Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Getgrav Grav
Products
Grav-plugin-api Grav-plugin-api
CVE-2026-112371

H3C Magic NX15 RPC esps write code injection

A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
H3c
Products
Magic Nx15 Magic Nx15 Firmware