Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 111,307

Export CSV
CVE-2026-127278

AIP-PUB ACPs-community verify-code Endpoint service_auth.py send_verification_code improper authentication

A weakness has been identified in AIP-PUB ACPs-community up to 2.2.0. The impacted element is the function send_verification_code of the file registry-server/app/account/service_auth.py of the component verify-code Endpoint. Executing a manipulation of the argument phone can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the reason "completed". However, it was not possible to determine the PR or commit which could have fixed this issue.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Aip-pub
Products
Acps-community
CVE-2026-125836

WordPress Simple JWT Login plugin <= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Nicu Micle Wordpress-extensions
Products
Simple Jwt Login Simple Jwt Login
CVE-2026-107484

Input Validation Vulnerability in Gaia Portal backend handlers allows privilege escalation by an authenticated user

An input and authorization validation vulnerability in Gaia Portal backend handlers could allow an authenticated, non-administrative user to perform privileged operations that should be restricted to administrators.

CVSS 3.1 · 7.3 High EPSS 1.9% KEV · Not listed
Vendors
Checkpoint
Products
Quantum Security Gateway Quantum Security Management
CVE-2026-116304

PostgreSQL parallel RECORD typmod use-after-free executes arbitrary code

Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-116306

PostgreSQL composite-type change during field assignment executes arbitrary code

Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via changing a composite type between deforming and reforming a value. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-116307

PostgreSQL plperl prepared-query use-after-free executes arbitrary code

Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-0169

Local Privilege Escalation via Debug Overlay Binding in Android.bp

In multiple functions of Android.bp, there is a possible way to bind to a privileged debug overlay service due to test or debugging code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-116313

PostgreSQL "vacuumdb --missing-stats-only" lets a database owner execute code as the vacuumdb user

Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pg_upgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-116314

PostgreSQL pg_restore executes arbitrary code due to missing non-plain archive validation

Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg_restore OS process. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-116315

PostgreSQL tsvector_delete() heap buffer overflow executes arbitrary code

Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-116325

PostgreSQL reindexdb index name quoting allows SQL injection

SQL injection in PostgreSQL reindexdb allows an object creator to execute arbitrary SQL as the database user running reindexdb, via a crafted index name embedded in the parallel catalog query for --jobs with --index. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-120141

PostgreSQL materialized set-returning function type confusion executes arbitrary code

Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types. json_populate_recordset() is one affected function. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-120142

PostgreSQL dropped-column type confusion executes arbitrary code

Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-120144

PostgreSQL type-cache invalidation gap executes arbitrary code

Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-120145

PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code

Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-120148

PostgreSQL extended-statistics pseudo-type confusion executes arbitrary code

Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-120149

PostgreSQL FDW batch-insert mismatch executes arbitrary code

Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-120150

PostgreSQL expanded-record domain-check use-after-free executes arbitrary code

Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-120151

PostgreSQL plpgsql record-field type confusion executes arbitrary code

Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-120153

PostgreSQL extension-script substitutions allow SQL injection through object names

SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql