Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,609

Export CSV
CVE-2026-105135

InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Internlm
Products
Mindsearch
CVE-2026-105089

WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe src attributes to execute JavaScript in victims' browsers.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Wwbn
Products
Avideo
CVE-2026-75937

OS Command Injection in Digi Accelerated Linux (DAL OS)

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Digi International
Products
Anywhereusb Plus Family Connect Ez Family Connect It Family and 9 more
CVE-2026-105221

Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Defunkt
Products
Gist
CVE-2026-105293

Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Legcord
Products
Legcord
CVE-2026-105294

Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig

Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add --proxy-server and --ignore-certificate-errors switches, routing all client traffic through an interception proxy.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Legcord
Products
Legcord
CVE-2026-100103

Authentication bypass via default auth token in P4Search

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Perforce
Products
Helix Core
CVE-2026-100102

RCE via exposed JDWP debug agent in P4Search

Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed
Vendors
Perforce
Products
Helix Core
CVE-2026-103510

Authentication bypass via blank auth token in P4Search

P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed
Vendors
Perforce
Products
Helix Core
CVE-2026-86131

Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os
CVE-2026-105778

Tenda AC5 Wifi setWifi stack-based overflow

A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Tenda
Products
Ac5 Ac5 Firmware
CVE-2026-76570

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Joomcode Joomcoder.com
Products
Jc Tables Jctables Extension For Joomla
CVE-2026-105080

Arbitrary Code Execution via Unvalidated Calibre Recipe Files

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
C4illin
Products
Convertx
CVE-2026-104849

Tinypool: Prototype Pollution Gadget to RCE in run() options

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process's privileges. This issue is fixed in version 2.1.2.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed
Vendors
Tinylibs
Products
Tinypool
CVE-2026-102425

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling `eval()`, the component replaces each shortcode with the raw value submitted by the visitor, leading to an RCE vector. A public form must use the product's optional PHP-after-submission action and interpolate an attacker-controlled field shortcode inside a double-quoted PHP string to be vulnerable.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed
Vendors
Balbooa Balbooa.com
Products
Forms Balbooa.com Balbooa Forms Extension For Joomla
CVE-2026-91107

openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Os4ed
Products
Opensis-classic
CVE-2026-105484

TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote.

CVSS 4.0 · 10 Critical EPSS 2.1% KEV · Not listed
Vendors
Totolink
Products
X6000r X6000r Firmware
CVE-2026-85153

Information Disclosure Vulnerability in Schmooze dating mobile Application

This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials and cryptographic keys. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to backend and cloud resources and forge client requests on the targeted system.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Schmooze
Products
Schmooze Dating Mobile Application
CVE-2026-105209

ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Zitadel
Products
Zitadel