Export limit exceeded: 425871 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 55,521

Export CSV
CVE-2026-125040

Gst-plugins-base: gst-plugins-base: quadratic regex processing in srt/webvtt subtitle parser causes denial of service

A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Rhel Els
CVE-2026-120326

Unescaped Download File Name Allows Content-Disposition Parameter Injection in Vaadin Flow

DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="<name>" with the name inserted verbatim, so a double quote in the name ends the quoted string early and the rest of the name is read by the browser as further header parameters. The inline(String) variant, present from Vaadin 25.0, builds the name the same way. An application that passes an untrusted file name to either method, for example when re-serving a file under the name it was uploaded with, lets an attacker add a filename* parameter. Browsers prefer filename* over filename, so the file is saved under a name and extension of the attacker's choosing, which defeats any file name or extension restriction the application enforces. The attacker cannot change the attachment or inline disposition itself and cannot split the header. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 24.8.0 - 24.8.17 Vaadin 24.9.0 - 24.9.25 Vaadin 24.10.0 - 24.10.13 Vaadin 25.0.0 - 25.0.13 Vaadin 25.1.0 - 25.1.13 Vaadin 25.2.0 - 25.2.12 Vaadin 25.3.0 - 25.3.4 Mitigation No fixed release on this line, upgrade to 24.9.26 or newer Upgrade to 24.9.26 Upgrade to 24.10.14 No fixed release on this line, upgrade to 25.2.13 or newer No fixed release on this line, upgrade to 25.2.13 or newer Upgrade to 25.2.13 Upgrade to 25.3.5 Vaadin versions below 24.8 are not affected: the DownloadEvent API does not exist in them.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-64629

Out-of-Bounds Read in Parasolid Leading to Code Execution

A vulnerability has been identified in Parasolid V38.0 (All versions < V38.0.235), Parasolid V38.1 (All versions < V38.1.230), Simcenter Femap (All versions < V2606.0002). The affected applications contains an out of bounds read vulnerability while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Siemens
Products
Parasolid
CVE-2026-120997

Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role

Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member's role once when a page mounts, in the assign_org_to_scope hook of NervesHubWeb.Auth, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects. The dashboard also opens consoles over NervesHubWeb.UserSocket with a token that holds only the user's id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session's LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user's current membership, until it expires. This issue affects nerves_hub: from 1.0.0 before 2.5.3.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Nerves-hub
Products
Nerves Hub Web
CVE-2026-125401

Ettercap through 0.8.4.1 Heap Buffer Overflow via Gadu-Gadu Dissector

Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field through a monitored network to corrupt heap memory in the Ettercap process, which normally runs as root.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Ettercap Ettercap-project
Products
Ettercap Ettercap
CVE-2026-104619

PackageKit ZYpp rollback vulnerability

Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Packagekit
Products
Packagekit
CVE-2026-107244

Unauthenticated Token Decryption Allows Remote Session Creation via Node.js Web Service

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.  Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

CVSS 3.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Versa
Products
Vos
CVE-2026-109833

Gnome-remote-desktop: heap buffer overflow in gnome-remote-desktop vnc tls peek buffer handling allows remote denial of service

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of compacting the peek buffer. A remote attacker who can reach an enabled VNC TLS listener and trigger a peek/read size mismatch can cause an out-of-bounds write, leading to denial of service.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux
CVE-2026-123369

compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tmatens
Products
Compose-lint
CVE-2026-123370

compose-lint: `fix --apply` can delete a line the user did not select, including a security setting

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Tmatens
Products
Compose-lint
CVE-2026-117477

HTTP Header Injection via Crafted URLs

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gmo Prime Strategy
Products
Kusanagi
CVE-2026-125358

Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink

Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Rehan-remade
Products
Universal-modder
CVE-2026-107241

Node.js Web Service Default Credentials Expose URL-based Provisioning on Versa VOS

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.  Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

CVSS 3.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Versa
Products
Vos
CVE-2026-93294

Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana Grafana Enterprise
CVE-2026-110712

libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted FileAllInformation replies to smb2_stat or smb2_fstat calls, crashing the client.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sahlberg
Products
Libsmb2
CVE-2026-110713

libsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERY_INFO replies with missing or oversized name lengths to crash the client.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sahlberg
Products
Libsmb2