Export limit exceeded: 425850 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,110

Export CSV
CVE-2026-110873

Heym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id Field

Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner's decrypted credentials are injected and exfiltrated.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Heymrun
Products
Heym
CVE-2026-113354

Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Finsys
Products
Dockhand
CVE-2026-71424

Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and _db_mcp_server_to_api_mcp_server returns that row through auth_template.headers to any BASIC_ACCESS user. This issue is fixed in versions 3.1.10, 3.2.14, and 4.0.0.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Onyx
Products
Onyx
CVE-2026-71184

Gitea fork workflow approval bypass through review events

Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository's runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-73126

Gitea private workflow badge token scope bypass

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository accessible to its owner. This discloses private workflow status beyond the token's intended delegated permissions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-84920

Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Unpublished Node Permissions
CVE-2026-106462

Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Backstage Linuxfoundation
Products
Backstage Plugin-scaffolder-backend Plugin-scaffolder-backend-module-azure and 11 more
CVE-2026-106463

Backstage: Improper authorization in GitLab organizational user ingestion

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticated user. This issue is fixed in version 0.8.7.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Backstage Linuxfoundation
Products
Backstage Plugin-catalog-backend-module-gitlab Backstage and 1 more
CVE-2026-84917

Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Jsonapi Role Access
CVE-2026-114067

Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Triggerdotdev
Products
Trigger.dev
CVE-2026-63830

net: skmsg: preserve sg.copy across SG transforms

In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through writable BPF ctx->data. This protects entries backed by pages that are not private to the sk_msg, such as splice-backed file page-cache pages. Several sk_msg transform paths move, copy, split, or compact msg->sg.data[] entries without moving the matching sg.copy bit. This can make an externally backed entry arrive at a new slot with a clear copy bit. A later SK_MSG verdict can then expose sg_virt(sge) as writable ctx->data and BPF stores can modify the original page cache. Keep sg.copy synchronized with sg.data[] whenever entries are transferred, shifted, split, or copied into a new sk_msg. Clear the bit when an entry is replaced by a newly allocated private page or freed. This covers the BPF pull/push/pop helpers, sk_msg_shift_left/right(), sk_msg_xfer(), and tls_split_open_record(), including the partial tail entry created during TLS open-record splitting.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-95639

Photoshop Desktop | Incorrect Authorization (CWE-863)

Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Photoshop Macos Windows
CVE-2026-96370

Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96398

Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96356

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96384

Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180

Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Mermaid Diagram Field
CVE-2026-96373

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96366

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-106492

Backstage: Improper preservation of access restrictions during service credential delegation

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Backstage Linuxfoundation
Products
Backend-defaults Backstage Backstage and 1 more