Export limit exceeded: 30248 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 30,248

Export CSV
CVE-2026-81707

openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email

openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows or keyserver responses to manipulate terminal output and display a fraudulent fingerprint, bypassing the out-of-band verification mechanism that protects against key substitution attacks.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Jahlives
Products
Openssl Encrypt
CVE-2026-81686

openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass

openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/negative, causing the concurrency gate to refuse all subsequent operations, or to a huge value removing the limit) or the unbounded DefaultTimeout, resulting in a persistent denial of service of the root daemon. The D-Bus service exists only on the 1.4.x line and was removed in 1.5.x.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jahlives
Products
Openssl Encrypt
CVE-2026-76840

RustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Length

RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStream_Read in libs/clipboard/src/windows/wf_cliprdr.c requests that many bytes of a remote file through cliprdr_send_request_filecontents and then executes CopyMemory(pv, clipboard->req_fdata, clipboard->req_fsize), where req_fsize is taken verbatim from the peer's CLIPRDR FileContentsResponse by wf_cliprdr_server_file_contents_response (req_fsize = fileContentsResponse->cbRequested) and is never clamped to cb anywhere in the chain. The function's only length comparison, req_fsize < cb, handles the short-read case and is evaluated after the copy has already occurred. A malicious or compromised peer that answers a small file-contents read with an oversized response therefore writes attacker-chosen data past the end of the paste consumer's heap buffer when the local user pastes clipboard file contents offered by the remote side. The file is a fork of FreeRDP's client/Windows/wf_cliprdr.c, where the same defect is CVE-2026-68579, fixed in FreeRDP 3.30.0.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Rustdesk
Products
Rustdesk
CVE-2026-74879

openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Jahlives
Products
Openssl Encrypt
CVE-2026-61503

Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences

Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Rejetto
Products
Hfs Http File Server
CVE-2026-101079

agentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decision

A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function isSecurityDefenseSkill of the file dist/scanner/analyzers/context.js. Performing a manipulation results in reliance on untrusted inputs in a security decision. The attack must be initiated from a local position. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Agentverus
Products
Agentverus-scanner
CVE-2026-101015

Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Trusted Domain Project
Products
Opendmarc
CVE-2026-100907

Eyeplus p2pcam Service snapshot information disclosure

A flaw has been found in Eyeplus 57.0.0.0308. The impacted element is an unknown function of the file /snapshot of the component p2pcam Service. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Eyeplus
Products
Eyeplus
CVE-2026-102587

Moodle: user list filters bypass profile field visibility

A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Moodle
Products
Moodle
CVE-2026-103280

Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-95364

chromium-browser: Improper input validation in Passwords

Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-95367

chromium-browser: Information leak in DataTransfer

Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-16037

Callback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Paytr
Products
Paytr Virtual Pos Iframe Api (v9x) Whmcs Module
CVE-2026-47522

nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Arbitrary code execution via improper input validation in kernel mode layer

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Geforce Nvs Quadro and 2 more
CVE-2026-95327

chromium-browser: Information leak in Networking

Information leak in Networking in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-47547

nvidia-driver: nvidia-driver: Arbitrary code execution via improper input validation in firmware

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Geforce Nvs Quadro and 2 more
CVE-2026-47546

nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: arbitrary code execution via improper input validation in firmware

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Geforce Nvs Quadro and 2 more
CVE-2026-47543

nvidia-driver: nvidia-driver: arbitrary code execution via improper input validation in kernel mode layer

VIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Geforce Nvs Quadro and 2 more
CVE-2026-47542

nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Arbitrary code execution via improper input validation in kernel mode layer

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Geforce Nvs Quadro and 2 more