Export limit exceeded: 425829 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 16978 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425829 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

You must be logged in to use the 'userTag' filter.
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,829

Export CSV
CVE-2026-87985

Arbitrary Code Execution via ANSI-C Quoted Argument Bypass in Mistral Vibe

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Mistral
Products
Mistral-vibe
CVE-2026-87986

Command Permission Bypass via Unparsed Shell Constructs in Mistral Vibe

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Mistral
Products
Mistral-vibe
CVE-2026-87987

Arbitrary Code Execution via Environment Variable Bypass in Mistral Vibe

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Mistral
Products
Mistral-vibe
CVE-2026-87988

Unrestricted File Access via Unvalidated Commands in Mistral Vibe

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Mistral
Products
Mistral-vibe
CVE-2026-15439

GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection

The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb->esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc_like() runs after WordPress core magic quotes, it doubles the injected backslash (\' -> \\'), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress_admin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher's Simple:Press vectors (PoC 2 & 3) do not reproduce in current code, which uses $wpdb->prepare() with %s placeholders; only the wpForo selector is confirmed.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Rubengc Wordpress
Products
Gamipress – Gamification Plugin To Reward Points, Achievements, Badges & Ranks In Wordpress Wordpress
CVE-2026-89090

Denial of service in the event stream header decoder in AWS SDK for Go v2

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range. To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Aws Sdk For Go V2
CVE-2026-62114

WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpchill
Products
Wordpress Passster
CVE-2026-62132

WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2026-87918

WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions

The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpbot
Products
Wordpress Wpot
CVE-2026-89080

Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Really-simple-plugins Wordpress
Products
Really Simple Security Wordpress
CVE-2026-86407

User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's email address, profile fields, role and membership order details. Exploitation requires the site owner to have added a user smart tag to that page's configurable message, which the shipped default does not contain.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-80087

Microsoft Office Information Disclosure Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 365 Apps Microsoft 365 and 8 more
CVE-2026-18122

Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization

Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate entries that its user context lacked permission to view, disclosing each entry's public identifier, URL, label, dates, and any attribute or associated-entry data requested via the includes parameter. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Concretecms
Products
Concrete Cms
CVE-2026-80072

User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-81909

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concrete/controllers/backend/block/process.php).It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the source block. A user granted only an area-scoped add_block_to_area delegation on their own page can therefore pass any block ID on the site: the source block's content is duplicated into an area the rogue editor controls, disclosing that content, and the original block is then force-deleted in the same request, destroying arbitrary site content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.9 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Concretecms
Products
Concrete Cms
CVE-2026-89771

ring-buffer: Fix subbuf resize race with ring buffer readers

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers trace_buffer subbuf_size is read lockless in ring_buffer_read_page() and ring_buffer_read_start(), while it can simultaneously be resized with ring_buffer_subbuf_order_set(). Instead of trace_buffer::subbuf_size, use bpage::order in ring_buffer_read_start() and ring_buffer_read_page(). In ring_buffer_read_start(), even with resize_disabled, there is still a possibility of a race with a buffer modification. Hold the trace_buffer mutex to synchronise with any pending ring buffer order modification. trace_buffer::subbuf_size is now actually useless, remove it. Also, create accessors rb_subbuf_capacity() and rb_page_capacity() which return the actual size available for storing events, while rb_subbuf_size() returns the actual subbuf page-size.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-89769

clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path When cpuhp_setup_state fails after pit_clockevent_per_cpu_init has successfully called request_irq, the error handling jumps directly to out_pit_clocksource_unregister without freeing the registered IRQ. This leaks the IRQ line and, since kfree(pit) follows, leaves a dangling pointer registered as the interrupt handler's dev_id, potentially leading to a use-after-free if the IRQ fires afterwards. Fix it by calling pit_clockevent_per_cpu_exit to properly release the IRQ before falling through to the existing cleanup chain.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel