Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,807

Export CSV
CVE-2026-115424

Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a malicious container image can exploit this vulnerability by embedding links, and a chained file entry, that reference locations outside the intended extraction directory. This allows the attacker to write attacker-controlled content to arbitrary locations on the host filesystem with the privileges of the user running the command, potentially leading to file modification outside the destination directory.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Container Platform
CVE-2026-110314

WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame. When a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handle_frame/3 and handle_info/3 never check that state, so later frames still reach handle_in/2 and later messages reach handle_info/2, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in init/1 after a failed token check could still run an admin-only action. This issue affects bandit: from 0.5.1 before 1.14.0.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mtrudel
Products
Bandit
CVE-2026-117563

MrDoc through 1.1.1 Broken Access Control via manage_doc_share

MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username to re-enable disabled shares or remove access codes, exposing private documents.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mrdoc
Products
Mrdoc
CVE-2026-101180

Denial of Service via File Parsing Module in HarmonyOS

DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Huawei
Products
Harmonyos
CVE-2013-20008

Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password

Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Linksys
Products
Wag200g
CVE-2026-105605

Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3

Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “duplicate my ad” convenience feature on the new-ad form (site/models/additem.php) loaded an existing advert by its raw numeric ID with no check that the ad belonged to the requesting user, and no check of whether it was published, blocked, or still a pending draft. Any logged-in user, regardless of role, could request the new-ad form with another ad’s ID and have that ad’s full content, including the seller’s phone number, address, email, and price, rendered into the response, even for ads that had never been published. Advert IDs are small sequential integers.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dj-extensions.com
Products
Dj-classifieds Extension For Joomla
CVE-2026-62991

Shopper: customer detail IDOR exposes administrator and staff records

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers` but looks up an arbitrary user ID without applying the `customers` role scope used by the listing. Authenticated staff holding `access_dashboard` and `read_customers` can change the user ID to retrieve administrator or staff profiles despite lacking `view_users`, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds `delete_customers`, `anonymizeAction()` operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Shopperlabs
Products
Shopper
CVE-2026-57187

Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJSIP TCP/SDP` handling by sending a `SIP INVITE` over a connection-oriented transport and disconnecting before Asterisk responds with the `200 OK`. So far, the crash has only been reproduced when Asterisk is built with `Address Sanitizer`, which detects the issue. `Address Sanitizer` is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Asterisk
Products
Asterisk Certified Asterisk
CVE-2026-116745

QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Qloapps Webkul
Products
Qloapps Qloapps
CVE-2026-119336

Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Pi-hole
Products
Pi-hole
CVE-2026-109141

Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import

The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Nlnetlabs
Products
Krill
CVE-2026-20770

Privilege Escalation via Protection Mechanism Failure in Cluster Management Toolkit

Protection mechanism failure for some Cluster Management Toolkit for Kubernetes software before version v0.8.5 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Intel
Products
Cluster Management Toolkit For Kubernetes Cluster Management Toolkit For Kubernetes Software
CVE-2026-120460

Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers

Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Dromara
Products
Jpom
CVE-2019-10072

tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

CVSS 3.0 · 7.5 High EPSS 73.0% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Jboss Enterprise Web Server
CVE-2017-13745

jasper: reachable abort in jpc_dec_process_sot()

There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack by triggering an unexpected jpc_ppmstabtostreams return value, a different vulnerability than CVE-2018-9154.

CVSS 3.0 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Jasper Project
Products
Jasper
CVE-2026-20903

Local Privilege Escalation via Protection Mechanism Failure in Intel AI Containers

Protection mechanism failure for some Intel(R) AI Containers before version v0.4.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Intel
Products
Ai Containers
CVE-2026-21387

Privilege Escalation via Protection Mechanism Failure in Intel LLM Library for PyTorch

Protection mechanism failure for some Intel(R) LLM Library for PyTorch within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Intel
Products
Llm Library For Pytorch
CVE-2026-20728

Protection Mechanism Failure Enabling Privilege Escalation in Intel Extension for TensorFlow

Protection mechanism failure for some Intel Extension for TensorFlow software before version 2.15.0.3 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Intel
Products
Extension For Tensorflow Extension For Tensorflow Software
CVE-2026-13204

Unexpected exit in certain situations with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Isc
Products
Bind