Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 481

Export CSV
CVE-2026-126814

blueprintUE Self-Hosted Edition before 4.3.6 Arbitrary Iframe Embedding via PeerTube Matcher

blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary third-party content by abusing the PeerTube video URL matcher in BlueprintService::findVideoProvider(). Attackers can set a blueprint video URL on an attacker-controlled host, which site.js loads in an unsandboxed iframe after consent, framing fake login forms or malware downloads.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Blueprintue
Products
Blueprintue-self-hosted-edition
CVE-2026-116330

PostgreSQL pg_dump tar restore.sql fails to block psql command injection

Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is undocumented. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-86504

Missing Project Trust Confirmation Allows Host‑Level Code Execution in JetBrains IntelliJ IDEA Dev Containers

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Intellij Idea
CVE-2026-118225

Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability

Inclusion of functionality from untrusted control sphere in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 17 more
CVE-2026-84725

Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Application Platform Els
CVE-2026-113767

Windows COM+ Event System Service Elevation of Privilege Vulnerability

Inclusion of functionality from untrusted control sphere in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more
CVE-2026-115791

Prevent shadowing stdlib in gzip/tarfile/zipfile CLI during extraction

When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is called traceback.py. The problem is that Python adds the current directory to sys.path when python -m MODULE is run, and the archive is also decompressed in the current directory. The fix removes sys.path[0] in gzip, tarfile and zipfile command line interface to prevent shadowing standard library modules from extracted files.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-64894

Inclusion of Untrusted Control Sphere Functionality Enables Malicious Software Update in Johnson Controls EasyIO Neo IOManager

Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Malicious Software Update. This issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Easyio Neo Iomanager And Tools Installer
CVE-2026-123849

Remote Code Execution via Terraform File Watchers in JetBrains IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Intellij Idea
CVE-2026-123843

Untrusted Projects May Alter GPG Agent Configuration in IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Intellij Idea
CVE-2026-123308

Untrusted Project Document Import Enables Code Execution in IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Intellij Idea
CVE-2026-123313

Enable Disabled Plugins via External Dependency Settings

In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Intellij Idea
CVE-2026-123833

Untrusted Project Database Connections in JetBrains IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Intellij Idea
CVE-2026-123838

Remote Code Execution via UI Designer Form File in Safe Mode

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Intellij Idea
CVE-2026-123293

Code Execution via Terraform Tool Path Setting in IntelliJ IDEA Before 2026.3

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Intellij Idea
CVE-2026-123302

Code Execution via Script Engine Discovery in Untrusted Projects

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discovery

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Intellij Idea
CVE-2026-123304

Execution via Malicious ShellCheck Path in IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Intellij Idea