Export limit exceeded: 111304 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 111,304

Export CSV
CVE-2026-82337

Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization

Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes with arguments they control. Deployments whose Dags use deadline alerts are affected. This is an incomplete fix of CVE-2026-45360, which only hardened the `reference` field; deployments that applied that fix remain affected through the `callback` and `interval` fields. Users of apache-airflow are recommended to upgrade to 3.4.0 or later.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Airflow
CVE-2026-40704

neural-compressor: neural-compressor: Privilege escalation via protection mechanism failure

Protection mechanism failure for some Intel Neural Compressor software before version master within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-121848

Magic Link < 2.2.6 - Subscriber+ Privilege Escalation via Magic Link Generation

The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen account, allowing any authenticated user, such as a subscriber, to generate a working login link for an administrator and log in as them.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Magic Link
CVE-2026-121866

Exsile SMS Gateway < 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option Update

The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Exsile Sms Gateway
CVE-2026-122001

Komfortkasse for WooCommerce < 1.4.9 - Administrator Account Creation via CSRF

The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonce verification so that a request forged in a logged-in administrator's browser is accepted, which can be used to create a new administrator account and fully take over the site.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Komfortkasse For Woocommerce
CVE-2026-104738

Advanced Form Integration <= 2.10.2 - Unauthenticated PHP Object Injection via $_POST Parameters

The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.2 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Exploitation requires that an administrator has previously configured at least one active NexForms integration (status=1) in the plugin's database table; in the free tier, only POST parameter keys containing the substrings 'name', 'email', 'first', or 'last' are routed to the vulnerable normalizer.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Nasirahmed Wordpress-extensions
Products
Advanced Form Integration Advanced Form Integration
CVE-2026-12977

Org.wildfly.core/wildfly-server: wildfly: rbac bypass in wildfly deployment-operation handlers leads to privilege escalation

A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Fuze 7 Jboss Enterprise Application Platform Jboss Enterprise Application Platform Expansion Pack and 4 more
CVE-2026-115864

Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory

Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called. A remote attacker can force a worker restart with each request of a few bytes.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Kazeburo
Products
Monoceros
CVE-2026-125396

Ghostscript before 10.08.0 -dSAFER Bypass via .putgstringcopy .forceput Recovery

Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, recover .forceput via a custom error handler, and cause a use-after-free across save/restore to execute arbitrary code.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Artifex Artifex Software Inc.
Products
Ghostpdl Ghostscript Ghostscript
CVE-2026-76973

Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (SAP Message Server)

Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sap Netweaver And Abap Platform
CVE-2026-107356

U.S. Geological Survey Area Species Management Research Program unrestricted file upload

U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed. Fixed on 2026-07-20.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
U.s. Geological Survey
Products
Area Species Management Research Program
CVE-2026-121862

Knowledge Building < 0.7.3 - Unauthenticated Stored XSS via knbu_new_reply AJAX Action

The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Knowledge Building
CVE-2026-121863

Knowledge Building < 0.7.3 - Reflected XSS via Comment Reply Response

The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them back in the response of an AJAX action available to unauthenticated users, and serves that response as HTML, leading to a Reflected Cross-Site Scripting.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Knowledge Building
CVE-2026-121870

Simpler Checkout < 1.5.4 - Subscriber+ Privilege Escalation via Forged Auto-Login Token

The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its automatic login link with a key that stays empty until the store owner configures the Simpler Checkout WordPress plugin before 1.5.4, allowing subscribers on stores that have not completed setup to log in as an administrator.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Simpler Checkout
CVE-2026-121998

iChart < 2.2.4 - Subscriber+ Arbitrary Post Read, Update and Deletion via IDOR

The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX actions, relying only on a nonce that any logged-in user can obtain, allowing users with a role as low as Subscriber to read, modify and permanently delete arbitrary posts and to overwrite a site-wide option.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Ichart
CVE-2026-123696

Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Authentication Reset

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor authentication enrolment, allowing unauthenticated users to remove the second factor from any account, or from every account at once.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Security For Woocommerce