Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 481

Export CSV
CVE-2018-11040

springframework: cross-domain requests via JSONP through AbstractJsonpResponseBodyAdvice

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Debian Oracle Vmware
Products
Debian Linux Agile Product Lifecycle Management Application Testing Suite and 25 more
CVE-2026-102677

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Electron Electronjs
Products
Electron Electron
CVE-2026-105331

mk-oracle: Local privilege escalation via malicious Oracle Instant Client

Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2026-105745

Docling: Plugin entry points are imported before the allow_external_plugins check

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/base_factory.py call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every module registered in the Docling entry-point group is imported even when external plugins are disabled. An installed third-party or compromised package can therefore execute import-time code when Docling starts, while the subsequent namespace filter misleadingly reports that the plugin was not loaded. This issue is fixed in 2.131.0.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Docling Docling-project
Products
Docling Docling
CVE-2026-87114

Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo

A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a stopped container. This allows a remote attacker to achieve arbitrary code execution on the operator's workstation. If the Docker daemon requires elevated privileges, the untrusted code may execute with root-mediated daemon privileges, posing a significant security risk.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Container Platform Pdrive Lightspeed and 1 more
CVE-2026-12171

auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF

auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require(), so running auto-changelog over attacker-controlled repository content (for example, in a CI workflow that checks out an untrusted pull request head, or locally on a forked or third-party repository) executes attacker-chosen code with the privileges of the invoking user or CI job, including access to workflow secrets, without the repository dependencies ever being installed. The plugins option similarly loads attacker-controlled modules from the repository. Under the same conditions, appendGitLog/appendGitTag allow git argument injection (e.g. --output= to write arbitrary files), output allows writing attacker-influenced content to arbitrary paths, and template causes an outbound request to an attacker-chosen URL. Version 2.6.1 treats in-repository configuration as untrusted and refuses to run when it sets these options, unless the new --unsafe-config flag is passed.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Cookpete
Products
Auto-changelog
CVE-2026-104811

Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution

DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality of the web portal listening on TCP port 443. The application is intended to allow users to upload WAV audio files but fails to properly validate the uploaded file type. An attacker can exploit this behavior to upload a malicious shared object (.so) instead of a WAV file. When the uploaded file is subsequently processed by the affected component, attacker-controlled code is loaded and executed in the context of the affected process. This can result in remote code execution and potentially full compromise of the underlying Linux system.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Mitel
Products
Mivoice Office 400
CVE-2026-63277

RCE via calcext:data-mappings, sql provider and jdbc connector

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
The Document Foundation
Products
Libreoffice
CVE-2026-105677

Ghost: Remote Code Execution via Theme Translation Files

Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. This issue is fixed in version 6.64.0.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-86131

Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os
CVE-2026-73076

Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`

Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2026-105080

Arbitrary Code Execution via Unvalidated Calibre Recipe Files

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
C4illin
Products
Convertx
CVE-2026-55251

NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pull_request and executes code supplied by the pull request before any maintainer review. Three PR-editable files drive this: "requirements.txt", ".pre-commit-hooks-config.yaml" / ".pre-commit-yamlfmt-config.yaml", and ".gitmodules". A contributor with no special repository access could open a pull request that modifies these files and have their code run on the CI runner. This issue has been patched via commit f41fc1e.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Netbox-community
Products
Devicetype-library
CVE-2026-104056

CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Authlib
Products
Authlib
CVE-2026-104809

Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A malicious shared object using the expected name can therefore be loaded by a privileged process. The module code then executes within the context and privileges of that process. This results in arbitrary code execution and full compromise of the Mitel Linux virtual machine.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-87057

olm-operator-konflux-sample: olm-operator-konflux-sample: Runtime base images referenced by mutable floating tags

A flaw was found in olm-operator-konflux-sample. The build pipelines use mutable floating tags to reference runtime base images instead of immutable SHA256 digests. This configuration allows for the content of the base images to be altered without detection, potentially leading to the introduction of malicious code or unexpected changes in the build process. An attacker could exploit this to compromise the integrity of the software supply chain.

CVSS 3.1 · 4.2 Medium EPSS n/a KEV · Not listed
Vendors
Olm-operator-konflux-sample
Products
Olm-operator-konflux-sample
CVE-2026-100256

Remote Code Execution via Structural Search Script Constraints in JetBrains IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Intellij Idea
CVE-2026-58569

Inclusion of Untrusted Functionality Allows Root Privilege Escalation on Dell PowerStore

Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges..

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerstore 1000t Powerstore 1200t Powerstore 3000t and 10 more
CVE-2026-97150

Arbitrary PHP Code Execution via Config.php Inclusion during Addon Migration

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Basercms Users Community
Products
Bcaddonmigrator