Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,935

Export CSV
CVE-2026-77649

Malicious Build-Time Code Execution via Rogue Dependency in Internment Crate

The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Droundy
Products
Internment
CVE-2026-49817

Dell Command Update Deserialization Vulnerability Allows Local Privilege Escalation

Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Command Update Dell Command Update (dcu)
CVE-2026-49816

Privilege Escalation via Deserialization of Untrusted Data in Dell Command Update

Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Command Update Dell Command Update (dcu)
CVE-2026-73397

WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability

Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress Youzify
Products
Wordpress Youzify
CVE-2026-73389

WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
The4 Wordpress
Products
Kalles Addons Wordpress
CVE-2026-74968

Site isolation issue in the Graphics: WebRender component

Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-74012

WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Steve Burge Wordpress
Products
Taxopress Wordpress
CVE-2026-73993

WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Roxnor Wordpress
Products
Fundengine Wordpress
CVE-2026-76850

LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes with pickle.loads(), and the isinstance check against DistServeCacheFreeRequest runs only after deserialization has already completed. The peer that supplies those bytes is caller-controlled: p2p_connect passes remote_engine_endpoint_info.zmq_address from the request body to connect() on the ZMQ PULL socket, and the POST /distserve/p2p_initialize and /distserve/p2p_connect endpoints in lmdeploy/serve/openai/api_server.py apply no authentication unless the server is started with api_keys, which defaults to None. A remote attacker can direct an engine to pull from a ZMQ endpoint under their control and execute arbitrary code in the engine process. Deployments that do not enable disaggregated serving are not affected, because the receive loop is only started once the migration backend accepts the connection.

CVSS 4.0 · 9.3 Critical EPSS 1.3% KEV · Not listed
Vendors
Internlm
Products
Lmdeploy
CVE-2021-26857

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS 3.1 · 7.8 High EPSS 95.8% KEV · Listed
Vendors
Microsoft
Products
Exchange Server
CVE-2023-21710

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS 3.1 · 7.2 High EPSS 7.9% KEV · Not listed
Vendors
Microsoft
Products
Exchange Server
CVE-2023-21707

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS 3.1 · 8.8 High EPSS 79.6% KEV · Not listed
Vendors
Microsoft
Products
Exchange Server
CVE-2026-58076

Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example `subprocess.check_output`, or `builtins.eval` on the `builtins`-prefixed variant. The code runs in the **Scheduler**, which reconstructs serialized Dags in its normal loop with no request involved, and in the **API server**, on any authenticated read of the Dag such as `GET /api/v2/dags/{dag_id}/details`. Both are components the Airflow security model states must never execute Dag-author code, and both hold the metadata database credentials and the JWT signing secret. No non-default configuration is required. This is a **different sink from CVE-2026-33264**, which covered only the trigger branch of the same deserializer: deployments that upgraded in response to that advisory are still affected through the exception branch and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later, which restricts the imported class to a subclass of `BaseException`.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Airflow