Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,609

Export CSV
CVE-2026-58179

Apache Traffic Server: regex_remap plugin overflows the stack from attacker input

The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-58161

Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-58155

Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-58154

Apache Traffic Server: Memory-safety errors in MIME and header parsing

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-82829

Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process

Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by exploiting hidden accounts or hard coded credentials. This issue affects Hitachi Coding Software Suite: through 3.3.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Hitachi Industrial Equipment Systems
Products
Hitachi Coding Software Suite
CVE-2026-82827

A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through 3.3.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Hitachi Industrial Equipment Systems
Products
Hitachi Coding Software Suite
CVE-2026-82825

Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed

Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrieval or alteration of sensitive information, or unauthorized manipulation. This issue affects Hitachi Coding Software Suite: through 3.3.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Hitachi Industrial Equipment Systems
Products
Hitachi Coding Software Suite
CVE-2026-82824

Path traversal may allow arbitrary files to be viewed, created, modified, or deleted

Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files. This issue affects Hitachi Coding Software Suite: through 3.3.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Hitachi Industrial Equipment Systems
Products
Hitachi Coding Software Suite
CVE-2026-103655

MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period

MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor. Because the system did not record whether a given TOTP period had already been consumed, the same code remained valid for its entire time window (typically 30 seconds). An attacker who captures a legitimate code during a user's login could replay it to authenticate a second session as that user. Preconditions: - The target user has TOTP-based two-factor authentication enabled. - The attacker is in a position to observe or intercept the TOTP code during a legitimate login (e.g., network-level interception, shoulder surfing, or a compromised client). - The replay must occur within the TOTP validity period. Security impact: - Unauthorized account access by replaying a captured one-time code. - Potential compromise of threat-intelligence data and administrative functions accessible to the targeted user. Affected versions: <v2.5.48.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Misp
Products
Misp
CVE-2026-102793

Ziroom ZHOME A0101 set_time_zone command injection

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /api/ZRFirmware/set_time_zone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 9.4 Critical EPSS 2.5% KEV · Not listed
Vendors
Ziroom
Products
Zhome A0101
CVE-2026-102361

mall4j through 4.0 Missing Authentication in Password Update Endpoint

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Gz-yami
Products
Mall4j
CVE-2026-101283

Pre-Authentication Heap Buffer Overflow in iperf3 RSA Decryption

iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Es
Products
Iperf3
CVE-2026-101276

Remote unauthenticated heap use‑after‑free in iperf3 3.21

iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Es
Products
Iperf3
CVE-2026-101264

Ziroom ZHOME A0101 set_passwd command injection

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 9.4 Critical EPSS 2.3% KEV · Not listed
Vendors
Ziroom
Products
Zhome A0101
CVE-2026-101261

Ziroom ZHOME A0101 firstSetup_wifi command injection

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the argument login_pwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 9.4 Critical EPSS 4.2% KEV · Not listed
Vendors
Ziroom
Products
Zhome A0101
CVE-2026-102427

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Ordasoft Ordasoft.com
Products
Joomla Cck Ordasoft Joomla Cck
CVE-2026-103475

yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Yii2-starter-kit
Products
Yii2-starter-kit
CVE-2026-89022

BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion

BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driver_id namespace. Attackers can authenticate at one enabled social provider using a user ID that matches an account linked to a different social provider, bypassing credential verification entirely because the SocialAuthService::handleLoginCallback query ignores the driver column when retrieving linked account records.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Bookstackapp
Products
Bookstack
CVE-2026-85695

FastChat Unauthenticated Worker Registration SSRF and Model Spoofing

FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompts, images, and responses, or probe internal network ports across the worker mesh.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Lm-sys Lmsys
Products
Fastchat Fastchat
CVE-2026-81719

openssl_encrypt before 1.4.9 Remote Code Execution via Plugin

openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The only default gate was an incomplete, bypassable AST denylist. If a user is induced to load an attacker's plugin, this results in arbitrary code execution with the privileges of the user running openssl_encrypt. Fixed in 1.4.9 by defaulting the signature policy to ENFORCE for non-built-in plugins.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Jahlives
Products
Openssl Encrypt