Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 719

Export CSV
CVE-2026-5515

IBM App Connect Enterprise is vulnerable to a confidential disclosure

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores potentially sensitive information in log files that could be read by a local user.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
App Connect Enterprise
CVE-2024-9334

Information Disclosure in E-Kent's Pallium Vehicle Tracking

Use of Hard-coded Credentials, Storage of Sensitive Data in a Mechanism without Access Control vulnerability in E-Kent Pallium Vehicle Tracking allows Authentication Bypass. This issue affects Pallium Vehicle Tracking: before 17.10.2024.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-36145

Multiple Vulnerabilities in watsonx.data

IBM watsonx.data 2.2 through 2.3.1 IBM Lakehouse does not properly restrict inbound and outbound connections which could allow an attacker to transfer or modify files without restrictions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Watsonx.data Watsonxdata
CVE-2026-39827

Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Golang
Products
Crypto Ssh
CVE-2025-32746

Insecure Storage of Sensitive Information in Dell PowerFlex Manager

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerflex Appliance Intelligent Catalog Powerflex Manager Powerflex Manager Appliance and 2 more
CVE-2025-32751

Insecure Storage of Sensitive Information in Dell PowerFlex Manager

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerflex Appliance Intelligent Catalog Powerflex Manager Powerflex Manager Appliance and 2 more
CVE-2023-2885

Channel Accessible by Non-Endpoint in CBOT's Chatbot

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM). This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Cbot
Products
Cbot Core Cbot Panel
CVE-2026-7257

Local Administrator Can Retrieve Decrypted Configuration Backup from Zyxel WRE6505

** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow a local attacker with administrator privileges to download and decrypt a backup configuration file.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Zyxel
Products
Wre6505 Wre6505 Firmware
CVE-2025-36180

Inadequate Pod Communication Restrictions, affects watsonx.data

IBM watsonx.data 2.2 through 2.3 IBM Lakehouse does not properly restrict communication between pods which could allow an attacker to transfer data between pods without restrictions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Watsonx.data Watsonxdata
CVE-2024-3596

RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

CVSS 3.1 · 9 Critical EPSS 14.9% KEV · Not listed
Vendors
Broadcom Freeradius Ietf and 2 more
Products
Brocade Sannav Fabric Operating System Freeradius and 9 more
CVE-2026-3291

Samsung Print Service Plugin – Potential Information Disclosure

Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hp
Products
Samsung Print Service Plugin
CVE-2023-6460

Information leak in nodejs-firestore

A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version 6.1.0 to avoid this issue

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Cloud Firestore
CVE-2026-22726

Route Services Firewall Bypass

Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to send requests to HTTP services on internal networks reachable by the Gorouter, which may not have previously had direct access from outside networks, or from the application. Routing release: affected from v0.118.0 through v0.371.0 (inclusive); upgrade to v0.372.0 or greater. CF Deployment: affected from v0.0.2 through v54.14.0 (inclusive); upgrade to v55.0.0 or greater (includes routing_release v0.372.0).

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Cloudfoundry
Products
Cf-deployment Routing-release Routing Release
CVE-2025-24117

App Fingerprinting via Improper Redaction on Apple Devices

This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, visionOS 2.3, watchOS 11.3. An app may be able to fingerprint the user.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ipados Iphone Os Macos and 2 more
CVE-2024-31278

WordPress Premium Addons for Elementor plugin <= 4.10.22 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium Addons for Elementor: from n/a through <= 4.10.22.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Leap13
Products
Premium Addons For Elementor
CVE-2025-24101

macOS Sequoia Improper Redaction Enables App Access to User‑Sensitive Data

This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3. An app may be able to access user-sensitive data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Macos
CVE-2025-43203

Cache Handling Leading to Note Image Disclosure with Physical Access

The issue was addressed with improved handling of caches. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26. An attacker with physical access to an unlocked device may be able to view an image in the most recently viewed locked note.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ios Ipados Iphone Os
CVE-2026-40868

kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explicitly set an Authorization header. Because context.apiCall.service.url is policy-controlled, this can send the kyverno serviceaccount token to an attacker-controlled endpoint (confused deputy). Namespaced policies are blocked from servicecall usage by the namespaced urlPath gate in pkg/engine/apicall/apiCall.go, so this report is scoped to ClusterPolicy and global context usage. This vulnerability is fixed in 1.16.4.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2025-10734

ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure

The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the syncedData function. This makes it possible for unauthenticated attackers to extract sensitive data including user names, emails, phone numbers, addresses.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Reviewx Wordpress
Products
Reviewx – Multi-criteria Reviews For Woocommerce With Google Reviews & Schema Wordpress