Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,831

Export CSV
CVE-2026-114135

Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.is_authorized(...) for the execute action on the kernels resource. A restricted authenticated user could therefore open an upstream kernel channel and obtain kernel execution despite the configured Authorizer denying that action, exposing data and credentials available to the kernel and permitting modification or disruption of the kernel environment. The default gateway configuration is fixed in version 2.6.0. In 2.6.0 and later, the same authorization bypass remains possible when a deployment manually registers the deprecated jupyter_server.gateway.handlers module, because its handler still omits the configured kernel-execute authorization decision.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Jupyter
Products
Jupyter Server
CVE-2019-25276

Studio 5000 Logix Designer 30.01.00 - 'FactoryTalk Activation Service' Unquoted Service Path

Studio 5000 Logix Designer 30.01.00 contains an unquoted service path vulnerability in the FactoryTalk Activation Service that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Rockwell Software\FactoryTalk Activation\ to inject malicious code that would execute with LocalSystem permissions.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Rockwellautomation
Products
Factorytalk Activation Studio Studio 5000 Logix Designer
CVE-2019-25269

Amiti Antivirus 25.0.640 - Unquoted Service Path Vulnerability

Amiti Antivirus 25.0.640 contains an unquoted service path vulnerability in its Windows service configurations. Attackers can exploit the unquoted path to inject and execute malicious code with elevated LocalSystem privileges by placing executable files in specific directory locations.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Microsoft Netgate
Products
Windows Amiti Antivirus
CVE-2016-20058

Netgate AMITI Antivirus build 23.0.305 Unquoted Service Path Privilege Escalation

Netgate AMITI Antivirus build 23.0.305 contains an unquoted service path vulnerability in the AmitiAvSrv and AmitiAntivirusHealth services that allows local attackers to escalate privileges. Attackers can place a malicious executable in the unquoted service path and trigger service restart or system reboot to execute code with LocalSystem privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Netgate
Products
Amiti Antivirus Netgate Amiti Antivirus
CVE-2016-20057

NETGATE Registry Cleaner build 16.0.205 Unquoted Service Path Privilege Escalation

NETGATE Registry Cleaner build 16.0.205 contains an unquoted service path vulnerability in the NGRegClnSrv service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can place a malicious executable in the unquoted path and trigger service restart or system reboot to execute code with LocalSystem privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Netgate
Products
Netgate Registry Cleaner Registry Cleaner
CVE-2026-115366

OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed plugins through a child namespace's sys/ mount, causing denial of service.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Openbao
Products
Openbao
CVE-2026-69979

Windows AppX Deployment Service Security Feature Bypass Vulnerability

Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 and 14 more
CVE-2026-110865

Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mend Renovatebot
Products
Mend-renovate-ce Helm Chart Mend-renovate-enterprise-edition Helm Chart Renovate-ce and 3 more
CVE-2024-3220

Default mimetype known files writeable on Windows

There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”). To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2026-115364

OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Openbao
Products
Openbao
CVE-2026-114659

Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Getgrav
Products
Grav-plugin-flex-objects
CVE-2026-113461

mk-oracle: Local privilege escalation via insecure Oracle Home library loading

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2026-95182

Untrusted Search Path in DeepSeek Harness Enables Arbitrary Code Execution

An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Deepseek
Products
Deepseek-harness
CVE-2026-110936

DLL Search Order Hijacking Enables Local Arbitrary Code Execution in Siemens Software Center

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Listed
Vendors
Siemens
Products
Software Center