Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,053

Export CSV
CVE-2026-98913

net: thunderx: fix PTP device ref leak in nicvf_probe()

In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvf_probe() cavium_ptp_get() acquires a reference to the PTP PCI device through pci_get_device(). If any initialization step fails after cavium_ptp_get(), the PTP PCI device reference is leaked. Add a common error path to release the PTP reference before returning from probe failures.

CVSS 3.1 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Linux Kernel
CVE-2026-104436

Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra Zebra-chain
CVE-2026-116141

ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder

ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-98948

mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() mlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template into a stack-local struct mlxsw_sp_acl_rule_info purely to compute rulei.values.elusage. Parsing can acquire port range registers via mlxsw_sp_flower_parse_ports_range(), but since this rulei never goes through mlxsw_sp_acl_rulei_destroy(), those registers were never released, including through chain template deletion. Factor out of mlxsw_sp_acl_rulei_destroy() the code to actually release the necessary resources and call from mlxsw_sp_flower_tmplt_create() to plug the leak. The issue was found during a review of Wentao Liang's patch referenced below.

CVSS 3.1 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Linux Kernel
CVE-2026-98962

btrfs: free iov when btrfs_uring_read_extent() fails

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfs_uring_read_extent() fails After btrfs_uring_read_extent(), the caller always jumped to out_acct. That skips kfree(data->iov), which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On failure, fall through to out_free instead.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Linux Kernel
CVE-2026-119137

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting the host stack.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Bytecodealliance
Products
Wasmtime
CVE-2026-96405

Aggregate DNS name chained pointer decompression work leads to degradation of service.

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nlnetlabs
Products
Unbound
CVE-2026-115969

Travisun Opptrix Schedule API setup command injection

A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 6.9 Medium EPSS 1.3% KEV · Not listed
Vendors
Travisun
Products
Opptrix
CVE-2026-115775

Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Twisted
Products
Twisted
CVE-2026-108086

Apache Cocoon: XEE could lead to SSRF and information disclosure

** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted external system As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Cocoon
CVE-2026-99047

gve: fix XSK buffer leak when rings are stopped

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK buffers when resetting ring state as a part of stopping queues. This causes all XSK buffers which are posted to the NIC to be leaked. Free XSK buffers attached to an allocated buf_state when stopping rings. This issue was hit in production.

CVSS 3.1 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Linux Kernel
CVE-2026-83645

Active Directory Federation Services (AD FS) Denial of Service Vulnerability

Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows Server 2012 and 11 more
CVE-2026-118589

nschloe meshio VTK Reader _vtk_42.py memory allocation

A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nschloe
Products
Meshio
CVE-2026-85319

Active Directory Federation Services (AD FS) Denial of Service Vulnerability

Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows Server 2012 and 11 more
CVE-2026-19867

Uncapped mention keys in user notification properties allow CPU exhaustion during post processing

Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user to degrade post-processing latency and consume excessive CPU on behalf of other members of any channel they share via storing an oversized notify_props.mention_keys list on their own profile.. Mattermost Advisory ID: MMSA-2026-00773

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-16251

Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized image response.. Mattermost Advisory ID: MMSA-2026-00726

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-41709

ESX insufficient logging vulnerability

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Listed
Vendors
Vmware
Products
Cloud Foundation Esx Esxi and 2 more
CVE-2026-115995

Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection

A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."

CVSS 4.0 · 9.4 Critical EPSS 1.4% KEV · Not listed
Vendors
Unitree Robotics Unitreerobotics
Products
Unitree Go2 Unitree Go2
CVE-2026-96951

Windows Shell Security Feature Bypass Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 8.8 High EPSS 9.8% KEV · Listed
Vendors
Microsoft
Products
Edge Chromium Outlook.com Outlook Web and 27 more