Export limit exceeded: 14426 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 16808 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,808

Export CSV
CVE-2026-35105

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 78). The redirect to the login page used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35107

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component). The redirect to the login page on logout used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35103

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability on the role assignment pending page (RoleAssignPending component). The redirect to the login page used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35104

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component). The redirect performed after registration used the value of the 'redirect' query parameter without validation, so a crafted registration link could send a user to an untrusted external site. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35106

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 89). A second redirect to the login page in this component used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-35102

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the navigation bar of the GenAI web interface (Navbar component). The switch-version action redirected the browser to a dynamically constructed URL (window origin + '/workspace') without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Aion
CVE-2026-92185

Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability

Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AbstractParser class. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-28929.

CVSS 3.0 · 7.2 High EPSS 1.9% KEV · Not listed
Vendors
Quest
Products
Foglight For Databases
CVE-2026-92198

Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability

Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getSource method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-29934.

CVSS 3.0 · 8.2 High EPSS 2.8% KEV · Not listed
Vendors
Quest
Products
Foglight For Databases
CVE-2026-121817

About Time Technologies｜Herowatch Go Server - Insecure Direct Object Reference

Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify specific parameters to access or operate other users' data and functions.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
About Time Technologies
Products
Herowatch Go Server
CVE-2026-121938

langchain4j-aideepin before 3.31.0 IDOR via GET /character/{uuid}

langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims' questions, AI answers, and attachment and audio URLs.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Moyangzhan
Products
Langchain4j-aideepin
CVE-2026-121945

CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint

CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/{id}/action to re-price, cancel or reschedule other stores' orders and tasks.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Coopcycle
Products
Coopcycle-web
CVE-2026-122148

MeetingBoard: MeetingBoard: Unauthorized screenshot capture via front-end validation bypass

In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot function by circumventing front-end interface restrictions. Exploitation can occur only when the attacker has a valid administrator account within the local network.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Yealink
Products
Meetingboard Pro
CVE-2026-109408

vault-java-driver: SslConfig silently disables requested TLS verification

vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than "true", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Jopenlibs
Products
Vault-java-driver
CVE-2026-112072

vault-java-driver: stored deeply nested JSON kills every thread that reads it

vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the reading thread. A Vault token that can write but not read a KV v2 path can store such a value there, so every later read of that path through the driver fails. This requires Vault 1.19.x or earlier, because 1.20 and later reject values nested deeper than 298 levels. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3 and is fixed in 7.0.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Jopenlibs
Products
Vault-java-driver
CVE-2026-1339

Open redirect vulnerability - UCMDB/Operations Bridge Manager

An Open Redirect vulnerability has been identified in OpenText™ Universal Discovery and CMDB. The vulnerability can be exploited only if an attacker sends a specially crafted URL containing a link to a malicious resource and a user subsequently follows that link. Affected systems: This issue affects only the classic deployment options for UCMDB UI (ucmdb-browser) component within Universal Discovery and CMDB and Operations Bridge Manager. Containerized deployment options are not affected.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Opentext
Products
Operations Bridge Manager Universal Discovery And Cmdb
CVE-2026-121880

RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership

Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session. NOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.

CVSS 4.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Posit Posit Software, Pbc
Products
Rstudio Server Workbench Posit Workbench and 1 more
CVE-2026-115732

Certificate Name Authorization Bypass

Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-109083

Apache Syncope: Remote Code Execution via Flowable JUEL expression

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Syncope
CVE-2026-113511

Apache Syncope: Delegated administration boundaries can be bypassed for Realm update

Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Syncope
CVE-2026-113687

Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Syncope