Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,608

Export CSV
CVE-2026-92414

Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Jackrabbit
CVE-2026-73642

Path Traversal in Dayforce ESS Excelity

Dayforce ESS Excelity is vulnerable to Path Traversal  in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Dayforce
Products
Ess Excelity Payroll
CVE-2026-73640

Time-based SQL Injection in Dayforce ESS Excelity

Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based Blind SQL Injection. This issue was fixed in version V3.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Dayforce
Products
Ess Excelity Payroll
CVE-2026-109573

phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint

phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq
Products
Phpmyfaq
CVE-2026-63350

Scripting Execution in Imported Trace Files Enables PLC Operations

Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-108598

Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Floci-io
Products
Floci
CVE-2026-108549

cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Chenhg5
Products
Cc-connect
CVE-2026-108268

enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session

Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in tdx-v0.2.43 and tdx-gpu-v0.6.27.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Privasys
Products
Enclave-os-virtual
CVE-2026-108265

enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session

Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in wasm-v0.40.0.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Privasys
Products
Enclave-os-mini
CVE-2026-39460

Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials

Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Red Lion Controls
Products
700 Series
CVE-2026-32645

Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials

Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Red Lion Controls
Products
700 Series
CVE-2026-106445

Handlebars: JavaScript Injection via Own Property Check Bypass

Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Handlebarsjs
Products
Handlebars
CVE-2026-33367

Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Red Lion Controls
Products
700 Series
CVE-2026-28745

Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format

Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Red Lion Controls
Products
700 Series
CVE-2026-15340

Savannah lwIP SMTP client Classic Buffer Overflow

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Savannah
Products
Lwip Smtp Client
CVE-2026-105278

Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials

The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Grid Protection Alliance
Products
Openpdc
CVE-2026-102628

Cadmos LTI exposure of sensitive information via debug mode

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment, including all .env configuration variables, in plaintext. Fixed on or before 2026-09-02.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Eummena
Products
Cadmos Lti
CVE-2026-100730

Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data

A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which could allow remote code execution under the privileges of the affected service account.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Grid Protection Alliance
Products
Openhistorian Openpdc
CVE-2026-108107

PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Hotspotbilling
Products
Phpnuxbill
CVE-2026-108109

PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Hotspotbilling
Products
Phpnuxbill