Export limit exceeded: 111304 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 111,304

Export CSV
CVE-2026-59607

Logic Check Bypass in Android TzPipelineInputExtractor Enables Local Privilege Escalation

In TzPipelineInputExtractor of TzPipelineInputExtractor.cpp, there is a possible Logic check bypass due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59609

Kernel Memory Corruption via Fence Identifier Reuse Leading to Local Privilege Escalation

In fence_manager_extract_iif of fence_manager.c, there is a possible way to corrupt kernel memory via fence identifier reuse due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-119512

WordPress Newsletters plugin <= 4.18.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.2.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed
Vendors
Tribulant Wordpress-extensions
Products
Newsletters Newsletters
CVE-2026-124260

WordPress WP Photo Album Plus plugin <= 9.3.06.001 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.06.001.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Jacob N. Breetvelt Wordpress-extensions
Products
Wp Photo Album Plus Wp Photo Album Plus
CVE-2026-128082

AutoMapper: Uncontrolled Recursion with Constructor Parameters

AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper increments type depth only after creating the destination, so recursive mapping performed through constructor parameters occurs before MaxDepth is counted. Destinations built through positional records or other constructors, and recursive ConstructUsing mappings that call context.Mapper, can therefore bypass explicit MaxDepth values and the default limit of 64. Deep attacker-influenced input can throw an uncatchable StackOverflowException and terminate the process. This issue is fixed in versions 15.1.4 and 16.3.0.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Luckypennysoftware
Products
Automapper
CVE-2026-128128

AIOHTTP: WebSocket max_msg_size bypass via integer overflow

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the C WebSocket reader adds a declared frame length to the size of an already buffered partial message using signed 64-bit arithmetic. A length near two to the power of 63 can overflow, allowing the max_msg_size check to pass. A remote peer can send a small non-final fragment followed by an oversized message and cause unbounded memory consumption. The Python WebSocket reader is unaffected. This issue is fixed in version 3.14.4.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Aio-libs
Products
Aiohttp
CVE-2026-9661

Postecert FIRMAOK! 1.6.29 Local Privilege Escalation via OpenSSL Search Path

Poste Italiane Postecert FIRMAOK! 1.6.29 on Windows contains a local privilege escalation vulnerability caused by an uncontrolled OpenSSL search path, where launcher.exe and dependent executables such as updater.exe and tslupdater.exe load OpenSSL configuration and library files from a hardcoded, user-writable directory that does not exist by default. A low-privileged local attacker can create this missing directory and place malicious OpenSSL configuration or library files inside it, causing the application to load and execute attacker-controlled code with the privileges of the user running it, enabling horizontal or, when a higher-privileged user runs the application, vertical privilege escalation up to full system compromise.

CVSS 4.0 · 7.3 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-70640

llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llama_context. Attackers can exploit this by performing heap spray with attacker-controlled data containing a fake vtable to hijack the vtable pointer at offset +0x30, causing llama_batch_allocr::clear() to dereference arbitrary memory and achieve remote code execution.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Ggml Ggml-org
Products
Llama.cpp Llama.cpp
CVE-2026-52789

BACnet Stack: Denial of Service (Infinite Loop) in handler_read_property_multiple via malformed RPM requests

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a Denial of Service (DoS) vulnerability exists in the BACnet stack's ReadPropertyMultiple (RPM) handler. When processing a malformed RPM request packet that lacks the expected closing tags, the function handler_read_property_multiple enters an infinite loop. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack
CVE-2026-52790

BACnet Stack: bacnet_device.c stack-use-after-return in writable Device string properties

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) over BACnet/IP resulting in a stack-use-after-return in writable Device string properties. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack
CVE-2026-63150

Omnispace Agora Project 26.10.0 CSRF via Administrator Account Creation

Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link or auto-navigating page that issues a plain GET request, exploiting the lack of CSRF protection and SameSite=Lax cookie behavior on top-level navigations to create unauthorized administrator accounts.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-91869

IBM Security QRadar EDR Improper Restriction of Excessive Authentication Attempts

IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to bypass security restrictions due to improper rate limiting on TOTP verification.

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed
Vendors
Ibm
Products
Security Qradar Edr
CVE-2026-109158

IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Insertion of Sensitive Information into Log File

IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sensitive information about the deployed environment within error messages.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Ibm
Products
App Connect Enterprise Certified Containers Operands App Connect Operator
CVE-2026-59578

AV1 Encoder Non‑Heap Buffer Overflow Leading to Local Privilege Escalation

In s_check_valid_tile_param_custom_tile of av1_encoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59582

Integer Overflow in UcePublishManager Leading to Remote Denial of Service

In StartTimer of UcePublishManager.cpp, there is a possible way to trigger a process abort during timer calculation due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59593

AV1 Decoder Heap Buffer Overflow Enables Local Privilege Escalation

In tile_info of av1_decoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59603

Double Free in Android Message Transport Service Leading to Remote Denial of Service

In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger a double free and process abort during message retry handling due to a use after free. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-129139

paicoding commit b8206b9 through 903adce Predictable ZSXQ Account Credentials

paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the victim's /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account.

CVSS 4.0 · 8.8 High EPSS n/a KEV · Not listed
Vendors
Itwanger
Products
Paicoding
CVE-2026-127214

Flowise 3.1.4 SSRF Bypass via Custom Function Sandbox

Flowise through 3.1.4 contains a server-side request forgery vulnerability that allows authenticated attackers with chatflows or agentflows create/update permissions to bypass the Custom Function sandbox's SSRF protection by requiring a module subpath inside an allowlisted package, such as axios/dist/node/axios.cjs or node-fetch/lib/index.js, which evades the vm2 mock table and returns an unwrapped HTTP client that skips the checkDenyList validation. Attackers can issue arbitrary GET and POST requests with attacker-controlled bodies via POST /api/v1/node-custom-function to reach loopback and internal-network addresses or the cloud metadata endpoint, enabling network mapping, credential disclosure, and state changes on internal services.

CVSS 4.0 · 6.3 Medium EPSS n/a KEV · Not listed
Vendors
Flowiseai
Products
Flowise