Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,608

Export CSV
CVE-2026-101157

Security Advisory 0192

A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated browser session, access sensitive data, modify system state, or disrupt affected services.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Arista
Products
Cloudvision Cue
CVE-2026-102162

Security Advisory 0193

On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device. The wireless gateway service is automatically restarted after a crash, allowing repeated exploitation attempts.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Arista
Products
Wi-fi Access Points
CVE-2026-102167

Security Advisory 0197

On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Arista
Products
Wi-fi Access Points
CVE-2026-102782

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic, non-sanitizing input filter, which strips HTML/script tags but never touches quotes or SQL syntax, and concatenates it directly into a query string with no escaping or parameterization:

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Ordasoft.com
Products
Ordasoft Simple Membership Extension For Joomla
CVE-2026-96408

Unauthenticated Code Injection via Upgrade Script in Movable Type

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Six Apart
Products
Movable Type Movable Type Cloud Edition Movable Type Premium and 1 more
CVE-2026-107459

Openfind｜SecuShare Pro - OS Command Injection

The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.

CVSS 4.0 · 9.3 Critical EPSS 1.5% KEV · Not listed
Vendors
Openfind
Products
Secushare Pro
CVE-2026-12260

SQL injection in the NetBoard CRM demo platform

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Netboard Crm
Products
Netboard Crm Demo Platform
CVE-2026-105110

Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter

OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.

CVSS 4.0 · 9.3 Critical EPSS 3.0% KEV · Not listed
Vendors
Iskratel
Products
Innbox
CVE-2026-107640

Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key matches the defaulted empty value, to take over administrator accounts after enumerating valid usernames.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Integrics
Products
Enswitch
CVE-2026-106126

Command Injection

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.

CVSS 4.0 · 9.4 Critical EPSS 2.2% KEV · Not listed
Vendors
Tenable
Products
Identity Exposure
CVE-2026-101158

Security Advisory 0185

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Arista
Products
Cloudvision Portal
CVE-2026-103416

Out-of-Bounds Write in TLS 1.3 Handshake Message Cache of NetX Duo

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Threadx Netx Duo
CVE-2026-105835

PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one succeeds, obtaining a full access token.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Planka
Products
Planka
CVE-2026-15688

Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting

Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modifying part of the executable module in memory, and thereby may be able to view, tamper with, destroy, or delete control programs.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Mitsubishielectric
Products
Gx Works3 Motion Control Setting
CVE-2026-103663

Path Traversal leading to Remote Code Execution in Ollama

Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store.  Critically if the server process has write access to `/usr/lib/ollama` (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root. This issue was fixed in version 0.35.0.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Ollama
Products
Ollama
CVE-2026-102828

simple-git unsafe-operation guard does not block trailer command configuration

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Simple-git Project Steveukx
Products
Simple-git Git-js
CVE-2026-9209

mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx

mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication enforced beyond a client-side sessionStorage flag. Attackers can submit arbitrary SQL through these exposed endpoints to invoke xp_cmdshell and xp_read_file, achieving pre-authentication remote code execution as LocalSystem via a single HTTP request.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Mjob
Products
Mjobtime
CVE-2026-82244

Budibase before 3.41.3 Remote Code Execution via Plugin eval()

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Budibase
Products
Budibase Server
CVE-2026-75917

SiYuan before v3.7.4 XSS-to-RCE via pathName.ts

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/movePathTo()) used by the 'move/link to' path-selection dialogs, where document metadata fields (bookmark, alias, memo, and an alternate name field) are concatenated into the aria-label HTML attribute without escaping. A document crafted with a double quote in any of these fields breaks out of the attribute context and injects arbitrary HTML attributes including inline event handlers (e.g., onmouseover). Because every SiYuan Electron BrowserWindow runs with nodeIntegration:true, contextIsolation:false, and no CSP, the injected handler gains require('child_process') access, escalating the XSS to arbitrary OS command execution when a victim merely hovers over the malicious document entry in the path-picker dialog. Malicious documents reach victims via sharing, sync, or import.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-72851

Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Budibase
Products
Budibase Server