Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,821

Export CSV
CVE-2026-55765

CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pg_stat_statements was preloaded with track_utility enabled and an untrusted tenant held pg_monitor or pg_read_all_stats, the tenant could recover platform-managed superuser or application-owner passwords, reconnect through enabled superuser TCP access, and execute operating system commands in the database pod with `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Cloudnative-pg
Products
Cloudnative-pg
CVE-2026-74986

Site isolation issue in the CSS Parsing and Computation component

Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-74981

Site isolation issue in the Audio/Video: Web Codecs component

Site isolation issue in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-74970

Site isolation issue in the Graphics component

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-78265

WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-63490

Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Jknack
Products
Handlebars.java
CVE-2026-55086

Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random() and place them in os.tmpdir(). On a host with a shared world-writable temporary directory, a local unprivileged attacker who predicts a filename can precreate a symbolic link to a file writable by the Etherpad process. Subsequent import or export operations can follow the link through fs.writeFile, fs.rename, or document-conversion output and overwrite the target with partially attacker-controlled content. This issue is fixed in version 3.1.0.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Etherpad
Products
Etherpad
CVE-2026-54457

TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration. Selecting the filesystem storage type allows arbitrary files on the gateway filesystem to be read, including credential files. Selecting the s3_compatible storage type causes outbound object-storage requests to attacker-chosen internal or cloud-metadata endpoints. Exploitation requires access to the gateway, which can be authenticated or unauthenticated depending on deployment configuration. This issue is fixed in version 2026.6.0.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Tensorzero
Products
Tensorzero
CVE-2019-25766

Renovate before 19.38.7 Credential Exposure via Go Modules

Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Renovatebot
Products
Renovate
CVE-2026-73325

Fujitsu OneCompression < 1.2.1 Arbitrary Code Execution via torch.load Deserialization

Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce__ methods in a crafted model checkpoint to execute arbitrary Python code, including system commands, when the library loads the file from a caller-selected model directory.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Fujitsu Research
Products
Onecompression
CVE-2026-78555

RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete actions. As a result, API credentials could be recovered by inspecting the page source or DOM. The credentials could also be unintentionally exposed through components that retain or inspect HTTP response bodies, such as debugging proxies, browser caches, monitoring systems, or other intermediaries. An attacker obtaining one of these tokens could subsequently authenticate using the privileges assigned to that key, including access to private data where the key was granted such permissions. The patch removes API keys from subsequent page rendering and replaces them with SHA-256-derived opaque handles. Administrative actions submit only these handles, which are resolved back to the corresponding token on the server. The full API key is therefore disclosed only once, when it is initially created.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Ransomlook
Products
Ransomlook
CVE-2026-76845

adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, "w", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines. An attacker able to create a symbolic link inside a shared, reused or predictable extraction directory, such as a temporary directory or a continuous integration workspace, can overwrite any file the extracting process is permitted to write.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Adm-zip Project Cthackers
Products
Adm-zip Adm-zip
CVE-2026-66650

WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Freightco Wordpress
CVE-2026-16989

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper resolution of symbolic links.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Aix Powervm Vios Vios
CVE-2026-78051

alexta69 MeTube Cookie File cookies.txt file access

A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2026.06.20 is sufficient to resolve this issue. Patch name: ce897ee00903bf7ded406f0d7852d95dd4164add. You should upgrade the affected component.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Alexta69
Products
Metube
CVE-2026-76404

Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Model Context Protocol Server Splunk Mcp Server App
CVE-2019-1961

Cisco Enterprise NFV Infrastructure Software Web Portal Arbitrary File Read Vulnerability

A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to the improper input validation of tar packages uploaded through the Web Portal to the Image Repository. An attacker could exploit this vulnerability by uploading a crafted tar package and viewing the log entries that are generated. A successful exploit could allow the attacker to read arbitrary files on the underlying OS.

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Cisco
Products
Enterprise Nfv Infrastructure Software
CVE-2019-1953

Cisco Enterprise NFV Infrastructure Software Password Recovery Vulnerability

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when logging in to the web portal for the first time. Subsequent password changes are not logged and other accounts are not affected. An attacker could exploit this vulnerability by viewing the admin clear text password and using it to access the affected system. The attacker would need a valid user account to exploit this vulnerability.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Cisco
Products
Enterprise Nfv Infrastructure Software