Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 58

Export CSV
CVE-2026-14242

Authorization bypass in the Git Sync provisioning jobs API

A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana Grafana Enterprise
CVE-2026-16237

PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition

Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 5.4 Medium EPSS n/a KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-120154

PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies

Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 4.3 Medium EPSS n/a KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-116316

PostgreSQL security-restricted operations can create types in pg_temp, which later queries of the session find

Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pg_temp. The victim session must later run a query containing an unqualified type name, e.g. "SELECT '1'::bigint"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-112809

Windows Composite Image File System Information Disclosure Vulnerability

Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 11 26h1 Windows 11 26h1
CVE-2026-112917

Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall

In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Docker
Products
Docker Desktop
CVE-2026-121440

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header restrictions the embedder intended.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bytecodealliance
Products
Wasmtime
CVE-2026-89419

openstack-ironic: openstack-ironic: maintenance state update bypasses set_maintenance policy via generic PATCH

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack
Products
Ironic
CVE-2026-76529

Improper Protection of Alternate Path in Splunk SOAR

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76529 are related to improper protection of alternate path and are grouped under the Common Weakness Enumeration (CWE) CWE-424.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk
CVE-2026-69979

Windows AppX Deployment Service Security Feature Bypass Vulnerability

Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 and 14 more
CVE-2026-110865

Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mend Renovatebot
Products
Mend-renovate-ce Helm Chart Mend-renovate-enterprise-edition Helm Chart Renovate-ce and 3 more
CVE-2026-114659

Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Getgrav
Products
Grav-plugin-flex-objects
CVE-2026-107352

Missing authorization checks in Amazon Athena engine version 3 request handling

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS remediated the issue on September 1, 2026, and has confirmed no customer metadata was accessed. No customer action is required.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Amazon Athena
CVE-2026-89039

Arbitrary file read via the convert_playwright_script prompt in mcp-k6

A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory (path traversal). The working-directory restriction applied to '@'-prefixed paths can also be bypassed with a symbolic link inside the working directory that points outside it.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Mcp K6
CVE-2026-93353

copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers

copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers to traverse symlinks leaving a volume's top directory and perform unauthorized file creation, deletion, or truncation via SSH_FXP_SETSTAT operations on paths outside any volume the account is authorized to access.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
9001
Products
Copyparty
CVE-2026-37008

Sandbox Escape via ctypes.CDLL in CrewAI

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Crewai
Products
Crewai
CVE-2026-86145

pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Pcre
Products
Pcre2