Export limit exceeded: 425758 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,758

Export CSV
CVE-2026-98157

EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation

In the Linux kernel, the following vulnerability has been resolved: EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation The poll_msec sysfs store file uses simple_strtoul() which accepts an unsigned long, but the target field (poll_msec) is unsigned int. On 64-bit systems, a value > UINT_MAX is silently truncated when stored. Fix the mismatch by using kstrtouint() instead. This rejects values larger than UINT_MAX at parse time, making truncation impossible. Also add a check for value < 1 to reject the 0-delay case, which would cause the poll work to spin without delay and consume 100% CPU.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-111922

Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins

Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Go-vikunja Vikunja
Products
Vikunja Vikunja
CVE-2026-28331

SolarWinds Patch Manager Sensitive Information Exposure Vulnerability

SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Patch Manager
CVE-2026-98155

accel/qaic: Address potential out-of-bounds read in resp_worker()

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in resp_worker() Although 'commit 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the owner went away")' fixes the scenario it was intended for by walking the message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it skipped over the bounds checking code that is included in decode_message(). This could lead to issues such as reading past the slab allocation's end, infinite loops or kernel panics. For those issues to happen, a malformed wire message is needed to be sent from the device. Instead of duplicating the bounds checking code already present in decode_message(), use the function inside resp_worker().

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-77936

Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access

Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Letta
Products
Letta
CVE-2026-63619

Apache Kylin: Missing authorization and path-confinement on system meta dump

Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-43851

Authenticated Path Traversal Vulnerability Enabling Arbitrary File Read on Advantech ADAM-3600

A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Adam-3600
CVE-2026-43849

Heap Memory Read Allows Sensitive Data Exfiltration in Advantech ADAM-3600

A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Adam-3600
CVE-2026-43847

Brute-Force Administrator Password Vulnerability in Advantech ADAM‑3600 Proprietary Protocol

A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Adam-3600
CVE-2026-43846

Stack‑Based Buffer Overflow Vulnerability in Advantech ADAM‑3600

A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Adam-3600
CVE-2026-113703

SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Giuseppe99barchetta
Products
Suggestarr
CVE-2026-113676

Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Froxlor
Products
Froxlor
CVE-2026-113612

SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Codewithcj
Products
Sparkyfitness
CVE-2026-113609

Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts

Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bandisoft
Products
Bandizip
CVE-2026-113599

Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Modoboa
Products
Modoboa
CVE-2026-113597

Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Blinko Blinkospace
Products
Blinko Blinko