Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,808

Export CSV
CVE-2023-33951

Kernel: vmwgfx: race condition leading to information disclosure vulnerability

A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context of the kernel.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Linux For Real Time and 3 more
CVE-2026-123329

YouTrack TeamCity Integration Authorization Flaw Exposes Project Actions

In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Youtrack
CVE-2026-123857

Local XML External Entity Vulnerability via PHPMD Ruleset Autodetection in PhpStorm

In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Phpstorm
CVE-2026-93325

Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx

Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-120427

MrDoc through 1.1.1 Missing Authorization via get_doctemp Template Read

MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retrieve the private template content of every user on the instance.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mrdoc
Products
Mrdoc
CVE-2026-116669

Tanium addressed an improper access controls vulnerability in Discover.

Tanium addressed an improper access controls vulnerability in Discover.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tanium
Products
Discover
CVE-2026-88799

MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover via IDOR

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-118187

PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-45514

Logic Error in Android Package Installation Allows Local Privilege Escalation

In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-49912

Potential Local Data Exposure from Media Carousel Post-Disablement

In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-87100

Missing Binary Hardening Causes Protection Mechanism Failure in Acronis Linux Executables

Protection mechanism failure due to missing binary hardening in Linux executables. The following products are affected: Acronis Cyber Protect 17 (Linux) before build 42587.

CVSS 3.0 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Acronis
Products
Acronis Cyber Protect 17
CVE-2026-87098

Improper Authorization Leads to Sensitive Information Disclosure in Acronis Cyber Protect

Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.

CVSS 3.0 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Acronis
Products
Acronis Cyber Protect 17
CVE-2026-67077

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or unauthorized actions through the affected application.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Aex
CVE-2026-63400

Coop sessions are not invalidated on password reset

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the password, leaving the compromised account under attacker control until the session expires at its `30-day` maximum age. This issue is fixed in version 1.0.2.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Roostorg
Products
Coop
CVE-2026-63338

IXP Manager has Broken Object-Level Authorization

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyController` selects records by identifier without checking that `user_id` matches the caller, allowing access to another user's API-key record. This issue is fixed in version 7.3.0.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Inex
Products
Ixp Manager
CVE-2026-62966

ESPAsyncWebServer multipart parser has null-pointer write

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when `BOUNDARY_OR_DATA` matches the closing boundary of a file part, before confirming the following terminator, while leaving `_itemIsFile` true. If the next byte is neither the final closing dashes nor a clean CRLF, the `DASH3_OR_RETURN2` or `EXPECT_FEED2` rewind branch re-injects provisionally consumed bytes through `itemWriteByte`. Because `_itemIsFile` remains true, `_itemBuffer`[`_itemBufferIndex`++] writes through a null pointer. On ESP32 this causes a `StoreProhibited` exception, panic and device reboot, producing remote denial of service. A route with a non-trivial body/upload handler, such as a file-upload or web-OTA endpoint, must be present. This issue is fixed in version 3.11.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Esp32async
Products
Espasyncwebserver
CVE-2026-120199

LearnHouse before 1.1.1 Missing Authorization via Assignment Submissions API

LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another user_id to the submissions grade endpoint or query submission read functions to view other students' work, grades and instructor feedback.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Learnhouse
Products
Learnhouse
CVE-2026-115402

Race Condition in OpenVPN ovpn-dco-win TCP Connect Path Enables Local Denial of Service

OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Openvpn
Products
Ovpn-dco-win
CVE-2026-114552

MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability

MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the parseObjectResponse method. The issue results from the lack of proper restriction of XML External Entity (XXE) references. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-29137.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mailenable
Products
Mailenable
CVE-2026-118995

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is documented to anchor the supplied pattern at both ends, but builds /^${rx}$/ without grouping the pattern. An alternation such as yes|no then accepts any value starting with yes or ending with no, and $ also accepts a value with one trailing newline. An authenticated user can submit values the pattern was meant to reject, which an application may then write into generated configuration files.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Perl
Products
Callbackery