Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 111,307

Export CSV
CVE-2026-92083

Pardus Image Writer Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's pardus-image-writer

Missing Authorization vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü pardus-image-writer allows Privilege Escalation. This issue affects pardus-image-writer: before 0.9.0.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-124018

Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission

Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-106152

External Control of Configuration Setting in Telerik Report Server

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and notifications. With user interaction, this can lead to disclosure of sensitive information and account takeover.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Telerik Report Server Telerik Report Server
CVE-2026-106140

Deserialization of Untrusted Data in Telerik Reporting Report Designers

In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Telerik Reporting Telerik Reporting
CVE-2026-111760

git: Git: Arbitrary code execution via unsafe submodule metadata during recursive clones

A flaw was found in Git. Unsafe handling of submodule-related repository metadata during recursive clone operations can lead to arbitrary code execution. A remote attacker could exploit this vulnerability by supplying a crafted repository that triggers unauthorized command execution on the host system when cloned recursively.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed
Vendors
Git
Products
Git
CVE-2026-75869

Authenticated command injection

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers through crafted DNS suffix values.

CVSS 3.1 · 8.8 High EPSS 20.4% KEV · Not listed
Vendors
Zohocorp
Products
Ddi Central
CVE-2026-111552

Multi-Factor Authentication Bypass in Hyper Technology's Hyper E-Commerce Infrastructure

Use of single-factor authentication vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Authentication Bypass. This issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-75868

Broken Access Control

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed
Vendors
Zohocorp
Products
Ddi Central
CVE-2026-119974

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 17 more
CVE-2026-110951

Password Reset via Unverified Email Leading to Account Takeover in Hyper Technology's Hyper E-Commerce Infrastructure

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Password Recovery Exploitation. This issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-75867

Broken Access Control

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed
Vendors
Zohocorp
Products
Ddi Central