Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,499

Export CSV
CVE-2026-2983

SourceCodester Student Result Management System Bulk Import import_users.php access control

A vulnerability was determined in SourceCodester Student Result Management System 1.0. The impacted element is an unknown function of the file /admin/core/import_users.php of the component Bulk Import. This manipulation of the argument File causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Munyweki Sourcecodester
Products
Student Result Management System Student Result Management System
CVE-2026-27668

Privilege Escalation via Improper Group Administration in Siemens RUGGEDCOM Secure Access Manager

A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5.8). User Administrators are allowed to administer groups they belong to. This could allow an authenticated User Administrator to escalate their own privileges and grant themselves access to any device group at any access level.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Siemens
Products
Ruggedcom Crossbow Secure Access Manager Primary (sam-p)
CVE-2026-3263

go2ismail Asp.Net-Core-Inventory-Order-Management-System Security API improper authorization

A vulnerability was found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118. Affected by this vulnerability is an unknown functionality of the file /api/Security/ of the component Security API. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Go2ismail
Products
Asp.net-core-inventory-order-management-system
CVE-2026-27802

Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, there is a privilege escalation vulnerability via bulk permission update to unauthorized collections by Manager. This issue has been patched in version 1.35.4.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Dani-garcia
Products
Vaultwarden
CVE-2026-3737

SourceCodester Pet Grooming Management Software User Creation add_user.php improper authorization

A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown part of the file add_user.php of the component User Creation Handler. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mayurik Sourcecodester
Products
Pet Grooming Management Software Pet Grooming Management Software
CVE-2026-3764

SourceCodester Client Database Management System superadmin_user_update.php improper authorization

A vulnerability was determined in SourceCodester Client Database Management System 1.0. The impacted element is an unknown function of the file /superadmin_user_update.php. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Lerouxyxchire Sourcecodester
Products
Client Database Management System Client Database Management System
CVE-2026-3209

fosrl Pangolin Role verifyApiKeyRoleAccess access control

A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiKeyRoleAccess of the component Role Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.4-s.4 mitigates this issue. The identifier of the patch is 5e37c4e85fae68e756be5019a28ca903b161fdd5. Upgrading the affected component is advised.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fosrl
Products
Pangolin
CVE-2026-3268

psi-probe PSI Probe Session Attribute RemoveSessAttributeController.java access control

A vulnerability was detected in psi-probe PSI Probe up to 5.3.0. The affected element is an unknown function of the file psi-probe-core/src/main/java/psiprobe/controllers/sessions/RemoveSessAttributeController.java of the component Session Attribute Handler. Performing a manipulation results in improper access controls. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Psi-probe
Products
Psi Probe
CVE-2026-0871

Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators

A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Jboss Enterprise Application Platform and 4 more
CVE-2026-21425

Incorrect Privilege Assignment Enables Local Privilege Escalation in Dell PowerScale OneFS

Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect privilege assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerscale Onefs
CVE-2026-27803

Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue has been patched in version 1.35.4.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Dani-garcia
Products
Vaultwarden
CVE-2026-3738

SourceCodester Pet Grooming Management Software Financial Report improper authorization

A vulnerability was identified in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the component Financial Report Page. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mayurik Sourcecodester
Products
Pet Grooming Management Software Pet Grooming Management Software
CVE-2026-3796

Qi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access control

A weakness has been identified in Qi-ANXIN QAX Virus Removal up to 2025-10-22. The affected element is the function ZwTerminateProcess in the library QKSecureIO_Imp.sys of the component Mini Filter Driver. Executing a manipulation can lead to improper access controls. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Qi-anxin Qianxin
Products
Qax Virus Removal Qax Internet Control Gateway
CVE-2026-3817

SourceCodester Patients Waiting Area Queue Management System patient-search.php improper authorization

A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. This issue affects some unknown processing of the file /patient-search.php. The manipulation results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Pamzey Sourcecodester
Products
Patients Waiting Area Queue Management System Patients Waiting Area Queue Management System
CVE-2026-3724

SourceCodester Patients Waiting Area Queue Management System checkin.php improper authorization

A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. This impacts an unknown function of the file /checkin.php. This manipulation of the argument patient_id causes improper authorization. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pamzey Sourcecodester
Products
Patients Waiting Area Queue Management System Patients Waiting Area Queue Management System
CVE-2026-3734

SourceCodester Client Database Management System Endpoint fetch_manager_details.php improper authorization

A flaw has been found in SourceCodester Client Database Management System 1.0. Affected is an unknown function of the file /fetch_manager_details.php of the component Endpoint. This manipulation of the argument manager_id causes improper authorization. The attack can be initiated remotely. The exploit has been published and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Lerouxyxchire Sourcecodester
Products
Client Database Management System Client Database Management System
CVE-2026-3762

SourceCodester Client Database Management System Endpoint superadmin_delete_manager.php improper authorization

A vulnerability has been found in SourceCodester Client Database Management System 1.0/3.1. Impacted is an unknown function of the file /superadmin_delete_manager.php of the component Endpoint. The manipulation of the argument manager_id leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Lerouxyxchire Sourcecodester
Products
Client Database Management System Client Database Management System
CVE-2005-0004

mysql: mysqlaccess creates/overwrite files on the system

The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack on temporary files.

CVSS 3.0 · 7.9 High EPSS < 1% KEV · Not listed
Vendors
Debian Mariadb Oracle
Products
Debian Linux Mariadb Mysql