Export limit exceeded: 425959 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 10823 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,823

Export CSV
CVE-2026-34785

Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path that begins with that string, including unrelated paths such as "/css-config.env" or "/css-backup.sql". As a result, files under the static root whose names merely share the configured prefix may be served unintentionally, leading to information disclosure. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Rack
Products
Rack
CVE-2026-23542

WordPress Grand Restaurant theme <= 7.0.10 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themegoods Wordpress
Products
Grand Restaurant Wordpress
CVE-2026-23544

WordPress Valenti theme <= 5.6.3.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection.This issue affects Valenti: from n/a through <= 5.6.3.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Codetipi Wordpress
Products
Valenti Wordpress
CVE-2026-27475

SPIP < 4.4.9 Insecure Deserialization

SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior access or another vulnerability) can trigger arbitrary object instantiation and potentially achieve code execution. The use of serialized data in these components has been deprecated and will be removed in SPIP 5. This vulnerability is not mitigated by the SPIP security screen.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Spip
Products
Spip
CVE-2026-2350

Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS.

Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tanium
Products
Interact Service Interact Service Tds and 1 more
CVE-2026-22345

WordPress Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery plugin <= 1.6.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery new-image-gallery allows Object Injection.This issue affects Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery: from n/a through <= 1.6.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
A Wp Life Wordpress
Products
Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery Wordpress
CVE-2026-22354

WordPress Woocommerce Category Banner Management plugin <= 2.5.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Dotstore Woocommerce Category Banner Management banner-management-for-woocommerce allows Object Injection.This issue affects Woocommerce Category Banner Management: from n/a through <= 2.5.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Dotstore Wordpress
Products
Woocommerce Category Banner Management Wordpress
CVE-2026-26222

DocLink .NET Remoting Unauthenticated Arbitrary File Read/Write RCE

Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI "doclinkServer.soap". The service does not require authentication and is vulnerable to unsafe object unmarshalling, allowing remote attackers to read arbitrary files from the underlying system by specifying local file paths. Additionally, attackers can coerce SMB authentication via UNC paths and write arbitrary files to server locations. Because writable paths may be web-accessible under IIS, this can result in unauthenticated remote code execution or denial of service through file overwrite.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Beyond Beyond Limits
Products
Altec Doclink Altec Doclink
CVE-2026-20791

Chargemap chargemap.com Insufficiently Protected Credentials

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Chargemap
Products
Chargemap.com
CVE-2026-27776

Insecure Deserialization in intra‑mart Accel Platform IM‑LogicDesigner Allowing Arbitrary Code Execution

IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue. This can be exploited only when IM-LogicDesigner is deployed on the system. Arbitrary code may be executed when some crafted file is imported by a user with the administrative privilege.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Intra-mart Ntt Data Intramart
Products
Accel Platform Intra-mart Accel Platform
CVE-2026-27167

Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret

Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable "mocked" OAuth routes when OAuth components (e.g. `gr.LoginButton`) are used. When a user visits `/login/huggingface`, the server retrieves its own Hugging Face access token via `huggingface_hub.get_token()` and stores it in the visitor's session cookie. If the application is network-accessible, any remote attacker can trigger this flow to steal the server owner's HF token. The session cookie is signed with a hardcoded secret derived from the string `"-v4"`, making the payload trivially decodable. Version 6.6.0 fixes the issue.

CVSS 3.1 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Gradio-app Gradio Project
Products
Gradio Gradio
CVE-2026-3422

e-Excellence｜U-Office Force - Insecure Deserialization

U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
E-excellence Edetw
Products
U-office Force U-office Force
CVE-2026-1265

IBM InfoSphere Information Server is vulnerable due to sensitive information written to a log file

IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to writing of sensitive Information in a log file.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Infosphere Information Server
CVE-2026-25906

Improper Link Resolution in Dell Optimizer Enables Local Privilege Escalation

Dell Optimizer, versions prior to 6.3.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Optimizer
CVE-2026-27905

BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.36, the safe_extract_tarfile() function validates that each tar member's path is within the destination directory, but for symlink members it only validates the symlink's own path, not the symlink's target. An attacker can create a malicious bento/model tar file containing a symlink pointing outside the extraction directory, followed by a regular file that writes through the symlink, achieving arbitrary file write on the host filesystem. This vulnerability is fixed in 1.4.36.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Bentoml
Products
Bentoml
CVE-2026-27971

Qwik affected by unauthenticated RCE via server$ Deserialization

Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.

CVSS 4.0 · 9.2 Critical EPSS 5.5% KEV · Not listed
Vendors
Qwik Qwikdev
Products
Qwik Qwik
CVE-2026-3452

Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block.

Concrete CMS below version 9.4.8 is vulnerable to Remote Code Execution by stored PHP object injection into the Express Entry List block via the columns parameter. An authenticated administrator can store attacker-controlled serialized data in block configuration fields that are later passed to unserialize() without class restrictions or integrity checks. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Thanks YJK ( @YJK0805 https://hackerone.com/yjk0805 ) of ZUSO ART https://zuso.ai/  for reporting.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Concretecms
Products
Concrete Cms
CVE-2026-24732

Improper permission checks in Extension:NSFileRepo

Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice (Extension:NSFileRepo modules) allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This issue affects BlueSpice: from 5.1 through 5.1.3, from 5.2 through 5.2.0. HINT: Versions provided apply to BlueSpice MediaWiki releases. For Extension:NSFileRepo the affected versions are 3.0 < 3.0.5

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Hallowelt
Products
Bluespice
CVE-2026-21786

HCL Sametime for iOS is affected by sensitive information disclosure

HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Sametime For Ios Sametime
CVE-2026-26196

Gogs: Access tokens get exposed through URL params in API requests

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params like token and access_token, which can leak through logs, browser history, and referrers. This issue has been patched in version 0.14.2.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gogs
Products
Gogs