Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11,120

Export CSV
CVE-2022-3693

Path traversal in FileOrbis File Management System

Path Traversal vulnerability in Deytek Informatics FileOrbis File Management System allows Path Traversal. This issue affects FileOrbis File Management System: from unspecified before 10.6.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Fileorbis
Products
Fileorbis
CVE-2026-0804

Axis OS Path Traversal via Unsigned ACAP Installation Exploits Privileged Access

An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Axis Axis Communications Ab
Products
Axis Os Axis Os
CVE-2026-45773

Turborepo: Login callback CSRF/session fixation

Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authentication, a malicious web page could send a request to the local callback server with an attacker-controlled token. If accepted before the legitimate callback, the CLI could complete login with the wrong credentials. This affects users authenticating the turbo CLI against self-hosted remote cache/auth endpoints. Vercel-hosted login flows using device authorization are not affected. This vulnerability is fixed in 2.9.14.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Vercel
Products
Turborepo
CVE-2026-7302

CVE-2026-7302

SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Lmsys Sglang
Products
Sglang Sglang
CVE-2026-45317

Open WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, an application-wide Cross-Site Request Forgery (CSRF) vulnerability was found Open-WebUl's image uploading functionality. An attacker can set an image URL to a malicious endpoint, allowing them to perform actions on behalf of a victim user. Any authenticated user can exploit this vulnerability, and any user who views the compromised image (e.g., a profile picture) will unknowingly send a GET request to the attacker-controlled URL. This can lead to cookie theft, denial of service (DoS), or other malicious actions. This vulnerability is fixed in 0.9.3.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Open-webui Openwebui
Products
Open-webui Open Webui
CVE-2021-47976

TextPattern CMS 4.9.0-dev Authenticated Remote Code Execution via Plugin Upload

TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files by exploiting the plugin upload functionality. Attackers can authenticate, retrieve a CSRF token from the plugin event page, and upload malicious PHP files to the textpattern/tmp/ directory for code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Textpattern
Products
Textpattern
CVE-2018-25334

Zechat 1.5 Cross-Site Request Forgery (CSRF) via hashtag parameter

Zechat 1.5 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to change a user's information by bypassing anti-CSRF protections. The application uses a CSRF token, but an attacker can use the hashtag parameter to inject an encoded payload and bypass the CSRF protection, allowing for unauthorized changes to user data. This can be exploited by tricking a user into submitting a crafted form or by using a script to obtain and set the CSRF token.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zechat Project
Products
Zechat
CVE-2018-25337

Joomla JoomOCShop 1.0 Cross-Site Request Forgery

Joomla JoomOCShop 1.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. Attackers can craft malicious HTML forms targeting account endpoints like /joomoc2/?route=account/edit and to modify user information or reset passwords without user consent.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Joomlaextensions
Products
Joomocshop
CVE-2026-42559

RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport

RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. This vulnerability is fixed in 1.4.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Modelcontextprotocol
Products
Rust-sdk
CVE-2026-28761

Cross‑Site Request Forgery in Fujitsu Musetheque V4 Allowing Unwanted Operations

Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a user views a malicious page while logged-in to the affected product, unexpected operations may be done.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Fujitsu
Products
Musetheque V4 Information Disclosure For Ipknowledge
CVE-2026-44695

Outline: Slack OAuth state can link a victim Outline account to an attacker Slack identity

Outline is a service that allows for collaborative documentation. Prior to 1.7.1, the Slack integration callback for GET /auth/slack.post accepts an unsigned, session-independent OAuth state value. A third party who can obtain a Slack OAuth code for the same Outline Slack client can make a logged-in Outline user complete the callback and link that user's Outline account to the attacker's Slack team_id and user_id. The linked Slack identity can then use the Slack /outline search command as the victim Outline user. This vulnerability is fixed in 1.7.1.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Getoutline
Products
Outline
CVE-2026-4527

Cross-Site Request Forgery (CSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to create unauthorized Jira subscriptions for a targeted user's namespace via a specially crafted link due to missing CSRF protection.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2026-41255

CKAN: CSRF exemption primed by anonymous requests

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. The marking was a member variable in flask-wtf.csrf.CSRFProtect(), which was stored as a module level variable in the flask_app middleware. This API was never intended for request level changes, it is primarily a decorator for static configuration. An unauthenticated request could hit a protected endpoint, exempting it from CSRF protection for the life of the particular server process. (e.g. one worker of uwsgi). This vulnerability is fixed in 2.10.10 and 2.11.5.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ckan Okfn
Products
Ckan Ckan
CVE-2026-8425

Notify Odoo <= 1.0.1 - Cross-Site Request Forgery to Settings Update

The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the _updateSettings function. This makes it possible for unauthenticated attackers to change the Notify Odoo URL to an attacker-controlled URL and modify notification, tracking image, and allowed IP address settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pektsekye Wordpress
Products
Notify Odoo Wordpress
CVE-2026-44364

misp-modules website - Missing CSRF protection in the website home blueprint

MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Misp
Products
Misp-modules
CVE-2026-44582

Next.js: Cache poisoning via collisions in React Server Component cache-busting

Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Vercel
Products
Next.js
CVE-2020-37217

Easy2Pilot 7 Cross-Site Request Forgery via admin.php

Easy2Pilot 7 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the admin.php?action=add_user endpoint with POST requests containing username and password parameters to create new administrative accounts without explicit user consent.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Easy2pilot
Products
Easy2pilot
CVE-2026-44347

Warpgate: SSO CSRF -- State Token Not Validated on Return

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on the attacker's account (such as writing sensitive data to the attacker's SSH target, or logging into an HTTP target that the attacker set up). This vulnerability is fixed in 0.23.3.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Warp-tech Warpgate Project
Products
Warpgate Warpgate
CVE-2026-42190

RedwoodSDK: Same-site CSRF in in server actions

RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. This issue has been patched in version 1.2.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redwoodjs
Products
Redwoodsdk Sdk