Export limit exceeded: 425803 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

Export CSV
CVE-2026-58782

Local Denial of Service via Logic Error in Android

In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-58791

Non-Heap Buffer Overflow in HEVC Decoder Allows Local Privilege Escalation

In pic_timing of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-129092

CCC Attestation SIG attested-tls-poc through commit 731ca82 TOCTOU via Handshake-Only Attestation

CCC Attestation SIG attested-tls-poc through commit 731ca82 contains a time-of-check time-of-use vulnerability because Evidence is appraised only once during the TLS handshake, without post-handshake re-attestation. Attackers with local access to the attesting endpoint can alter workload code, data, configuration, or attached devices like GPUs while peers keep trusting the original Evidence.

CVSS 4.0 · 7 High EPSS n/a KEV · Not listed
Vendors
Ccc-attestation
Products
Attested-tls-poc
CVE-2026-128034

gittuf: File protection rules bypassed for filenames with special characters

In gittuf before 0.18.0, verification of file protection rules uses the quoted, escaped pathnames that Git prints by default for files with special characters (for example non-ASCII characters) instead of the raw paths. Such paths do not match patterns like file:internal/*, so the files are treated as unprotected, and a user who is not authorized by a file protection rule can change a protected file whose name contains special characters and still pass verification.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed
Vendors
Gittuf
Products
Gittuf
CVE-2026-128035

gittuf: Propagated controller policies not loaded during verification

In gittuf 0.10.0 through 0.17.0, the verification workflow does not load policy updates that are propagated from an upstream (controller) repository and recorded in the reference state log after the first entry being verified. Only the propagated policy in effect at the start of verification is applied, so later controller changes to global rules, such as threshold requirements and force-push blocks, are ignored and changes that these rules should block pass verification.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed
Vendors
Gittuf
Products
Gittuf
CVE-2026-128036

gittuf: Invalid intermediate policies trusted when the policy apply workflow is bypassed

In gittuf 0.4.0 through 0.16.0, when a policy update appears within the range of reference state log entries being verified, verification checks only the root of trust signatures of the new policy and not the signatures of its other metadata (rule files). A user trusted to push to the repository who bypasses gittuf policy apply and writes the policy reference and reference state log directly can make an invalid policy apply during verification, weakening or strengthening the rules for later changes. The update is still recorded in the reference state log.

CVSS 3.1 · 2.3 Low EPSS n/a KEV · Not listed
Vendors
Gittuf
Products
Gittuf
CVE-2026-126818

Mongoid 9.1.1 incomplete CVE-2026-93764 fix stores descendant-only encrypted fields in plaintext

A Ruby object-document mapper does not apply its automatic field-level encryption configuration to certain fields when the data model uses class inheritance. Values the application designated for encryption are written to the database in readable form without any error or warning. A database account holding only read access to the application's collections, and no access to the encryption key store, may obtain those values.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Mongodb
Products
Ruby Driver
CVE-2026-52789

BACnet Stack: Denial of Service (Infinite Loop) in handler_read_property_multiple via malformed RPM requests

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a Denial of Service (DoS) vulnerability exists in the BACnet stack's ReadPropertyMultiple (RPM) handler. When processing a malformed RPM request packet that lacks the expected closing tags, the function handler_read_property_multiple enters an infinite loop. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack
CVE-2026-52790

BACnet Stack: bacnet_device.c stack-use-after-return in writable Device string properties

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) over BACnet/IP resulting in a stack-use-after-return in writable Device string properties. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack
CVE-2026-62974

BACnet Stack: Remote unauthenticated DoS in `Life_Safety_Zone` `PROP_ZONE_MEMBERS` WriteProperty parsing

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a malformed but non-empty BACnet WriteProperty request can drive the official server demo into a non-terminating request-processing loop with repeated heap-backed side effects. This results in a remote unauthenticated denial of service via uncontrolled resource consumption and a non-terminating request path. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack
CVE-2026-63150

Omnispace Agora Project 26.10.0 CSRF via Administrator Account Creation

Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link or auto-navigating page that issues a plain GET request, exploiting the lack of CSRF protection and SameSite=Lax cookie behavior on top-level navigations to create unauthorized administrator accounts.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-129173

Stirling-Tools Stirling-PDF Participant Details Endpoint WorkflowParticipantController.java session timeout

A security flaw has been discovered in Stirling-Tools Stirling-PDF up to 3.3.0. Affected is the function WorkflowParticipantController.getParticipantDetails of the file app/proprietary/src/main/java/stirling/software/proprietary/workflow/controller/WorkflowParticipantController.java of the component Participant Details Endpoint. Performing a manipulation results in insufficient session timeout value. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
Stirling-tools
Products
Stirling-pdf
CVE-2026-82102

DataStage on Cloud Pak for Data has vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.

CVSS 3.1 · 6.4 Medium EPSS n/a KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-91868

IBM Security QRadar EDR Improper Access Control

IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed
Vendors
Ibm
Products
Security Qradar Edr
CVE-2026-91869

IBM Security QRadar EDR Improper Restriction of Excessive Authentication Attempts

IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to bypass security restrictions due to improper rate limiting on TOTP verification.

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed
Vendors
Ibm
Products
Security Qradar Edr
CVE-2026-109158

IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Insertion of Sensitive Information into Log File

IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sensitive information about the deployed environment within error messages.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Ibm
Products
App Connect Enterprise Certified Containers Operands App Connect Operator
CVE-2026-114468

IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Hard-coded Credentials

IBM App Connect Operator and App Connect Enterprise Certified Containers Operands could allow an attacker with the ability to run HTTP calls within the running container to can make administrative calls to a running IntegrationRuntime.

CVSS 3.1 · 6 Medium EPSS n/a KEV · Not listed
Vendors
Ibm
Products
App Connect Enterprise Certified Containers Operands App Connect Operator
CVE-2026-58806

Logic Error in Android get_sswrp_state Allows Local Information Disclosure

In get_sswrp_state of cpm_mbox_srv/main.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-58807

Memory Exhaustion in Android MtsMessageController Leading to Remote Denial of Service

In Retry_MtsMessageInPending of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via leaked message objects due to a logic error. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—