Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,609

Export CSV
CVE-2026-91135

Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)

Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2026-83632

Apache Thrift: C++ THttpTransport grows its line buffer without bound

Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2026-103473

Deno 2.7.0 through 2.9.7 Command Injection via node:child_process

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with Deno process privileges.

CVSS 4.0 · 9.2 Critical EPSS 1.5% KEV · Not listed
Vendors
Deno
Products
Deno
CVE-2026-104467

YesWiki before 4.6.7 Authorization Bypass via Public API Mode

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_config and api/archives to overwrite configuration and list, download, or delete backup archives.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Yeswiki
Products
Yeswiki
CVE-2026-94620

Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, `gh teacher download` clones each student's assignment repository and then writes autograde artifacts (`result.json` and `results.json`) into the just-cloned working tree. The write followed symlinks, so a student who committed `result.json` or `results.json` as a **symlink** (materialized verbatim by `git clone`) could redirect the teacher's write to an arbitrary path — e.g. `~/.zshrc`, `~/.ssh/authorized_keys`, a cron file, or an in-clone `.git/hooks/*` file that git subsequently executes. The written bytes are attacker-controlled (the student's uploaded release asset for `result.json`; student-chosen submit-tag names for `results.json`). This is an arbitrary file write leading to code execution as the teacher, whose `gh` token carries `admin:org`, `repo`, and `workflow` across the entire classroom organization. Version 1.11.0 contains a patch. Some workarounds are available. Avoid running `gh teacher download` against untrusted student repositories, or run it inside a disposable sandbox / container with no access to sensitive host files or credentials. Inspect cloned trees for symlinked, hardlinked, or special (`result.json`/`results.json`) entries before allowing the artifact-refresh step to run.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Foundation50
Products
Classroom50
CVE-2026-14984

Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2

Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Teledyne Flir
Products
Aware2
CVE-2026-55393

Local File Inclusion in Teledyne FLIR Robots running Aware2

Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook robots running this software via path traversal.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Teledyne Flir
Products
Aware2
CVE-2026-55395

Hardcoded Passwords in Teledyne FLIR Robots running Aware2

Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to access and reconfigure Teledyne FLIR PackBot and FirstLook robots running this software via reading the passwords from the firmware or documentation.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Teledyne Flir
Products
Aware2
CVE-2026-104611

Tenda AC9 POST Request fast_setting_internet_set stack-based overflow

A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fast_setting_internet_set of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Tenda
Products
Ac9 Ac9 Firmware
CVE-2026-104610

Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow

A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Tenda
Products
Hg10 Hg7 Hg9
CVE-2026-93985

OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE

OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Openpanel
Products
Openpanel
CVE-2026-53988

Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints

Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send unsigned webhook requests to force git clone and docker compose operations, enabling denial of service or, when combined with write access to the tracked git branch, container escape and full host compromise via attacker-controlled docker-compose.yml with privileged bind mounts.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Finsys
Products
Dockhand
CVE-2026-102792

Ziroom ZHOME A0101 set_syslog command injection

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of the file /api/ZRnetwork/set_syslog. The manipulation of the argument conloglevel/log_size results in command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 9.4 Critical EPSS 3.0% KEV · Not listed
Vendors
Ziroom
Products
Zhome A0101
CVE-2026-86325

Stack-based Buffer Overflow in Moxa MGate Account Management Interface

A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management requests. An attacker authenticated as a read-only user to the web management interface could supply a specially crafted account name that exceeds the size of the internal stack buffer, resulting in corruption of program execution flow. Successful exploitation could allow an attacker to read sensitive information from device memory, including credentials, modify arbitrary memory contents, and disrupt device availability.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Moxa
Products
Mgate Mb3170 Series Mgate Mb3270 Series
CVE-2026-14157

Externally Controlled Format String in ASUS Router Web Interface Allows Remote Command Execution

Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Asus
Products
Router
CVE-2026-11499

Tenda HG7/HG9/HG10 formDOMAINBLK stack-based overflow

A vulnerability was determined in Tenda HG7, HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote.

CVSS 4.0 · 9.3 Critical EPSS 6.6% KEV · Not listed
Vendors
Tenda
Products
Hg10 Hg7 Hg7hg9 and 1 more
CVE-2023-54344

Eclipse Equinox OSGi 3.7.2 Remote Code Execution via Console

Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending payloads to the console interface. Attackers can connect to the OSGi console port and send base64-encoded bash commands wrapped in fork directives to achieve code execution and establish reverse shell connections.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Eclipse Equinox
Products
Equinox [osgi
CVE-2023-54342

Eclipse Equinox OSGi 3.8-3.18 Console Remote Code Execution

Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to execute arbitrary code by exploiting the fork command functionality. Attackers can establish a telnet connection to the OSGi console, perform a telnet handshake, and send fork commands to download and execute malicious Java code, establishing a reverse shell connection.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Eclipse Equinox
Products
Equinox [osgi
CVE-2023-53983

Anevia Flamingo XL/XS 3.6.20 Default Credentials Authentication Bypass

Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Attackers can leverage these hard-coded credentials to gain full remote system control without complex authentication mechanisms.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Ateme
Products
Flamingo Flamingo Xl Flamingo Xl Firmware and 4 more
CVE-2018-25318

Tenda FH303/A300 V5.07.68_EN Cookie Session Weakness DNS Change

Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient cookie validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin cookie to change DNS servers and redirect user traffic to malicious sites.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Tenda
Products
A300 A300 Firmware Fh303 and 2 more