Export limit exceeded: 425694 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,694

Export CSV
CVE-2026-128328

Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoDirectories repoPath

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directory names of other tenants' application and compose source trees on the host or managed servers.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2026-128329

Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoFile

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to read arbitrary files by supplying ../ sequences in the filePath of patch.readRepoFile. Attackers with service read permission can read /etc/shadow, SSH private keys, and secret environment files on the Dokploy host or managed remote servers.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2026-128330

Miniflux before 2.3.5 Insufficient Session Expiration After Password Change

Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because password changes do not revoke existing web sessions. Attackers holding a leaked password or copied session cookie keep access for up to 30 days, reading integration credentials, creating API keys, or registering passkeys.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Miniflux Project
Products
Miniflux
CVE-2026-128331

Miniflux before 2.3.5 Password Change Without Current Password via Settings Form

Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Miniflux Project
Products
Miniflux
CVE-2026-128332

listmonk 6.0.0 before 7.0.0-beta.2 TOTP Brute-Force via /admin/login/twofa

Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, each allowing 15 more guesses, gaining sessions for 2FA-protected accounts including Super Admin.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-128333

listmonk 6.0.0 before 7.0.0-beta.2 2FA Bypass via Password Reset Flow

listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP verification after a password reset. Attackers who can complete a reset, such as by reading the victim's reset email, obtain fully authenticated sessions including Super Admin without the TOTP code.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-128334

listmonk 6.2.0 before 7.0.0-beta.2 Missing Authentication via Azure Bounce Webhook

listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliveryReportReceived events with Bounced status to /webhooks/service/azure to blocklist, unsubscribe, or delete arbitrary subscribers.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-128335

Contao before 5.3.54, 5.7.17, and 6.0.6 Session Invalidation Failure on 2FA Change

Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Contao
Products
Contao
CVE-2026-128336

ExcelJS through 4.4.0 Prototype Pollution via __proto__ Defined Name

ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a __proto__ sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets __proto__, causing CellMatrix to write empty arrays onto Object.prototype process-wide when workbook.xlsx.load() runs.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-128337

ExcelJS through 4.4.0 Prototype Pollution via x14 Conditional Formatting Rule ID

ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of __proto__. Attackers can craft an xlsx file that, when loaded with xlsx.load(), sets properties such as type, direction, border and cfvo on every object in the process until it restarts.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-128338

ExcelJS through 4.4.0 Memory Exhaustion via Unbounded Worksheet Column Range

exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col element with an unbounded max attribute. Attackers can craft a small workbook with a huge max value, causing xlsx.load() to allocate hundreds of millions of Column objects and abort the process with an uncatchable heap out-of-memory error.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-128339

ExcelJS through 4.4.0 Memory Exhaustion via Oversized Merged Cell Range

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load() to create billions of Row and Cell objects and abort the process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-128340

ExcelJS through 4.4.0 Memory Exhaustion via Oversized Defined Name Range

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal heap out-of-memory error during xlsx.load().

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-128341

ExcelJS through 4.4.0 Denial of Service via Oversized Data Validation sqref

ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to make xlsx.load() iterate billions of addresses, blocking the event loop and crashing the process with an uncatchable out-of-memory error.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-128342

ExcelJS through 4.4.0 Denial of Service via Oversized Worksheet sheetId

ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and writeBuffer for seconds.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-128343

ExcelJS through 4.4.0 Denial of Service via Oversized Row Number

exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues(), workbook writes and CSV export consume time proportional to that number.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-128344

ExcelJS through 4.4.0 Memory Exhaustion via Oversized Image Anchor Column

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages() anchor positions makes Worksheet.getColumn allocate millions of Column objects and abort with a heap out-of-memory error.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-128345

ExcelJS through 4.4.0 ReDoS via slideFormula Shared Formula Translation

ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic regex backtracking that blocks the Node.js event loop.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-128346

ExcelJS through 4.4.0 Resource Exhaustion via Streaming WorkbookReader Temporary Files

ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before xl/sharedStrings.xml to fill the temporary directory and exhaust file descriptors.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs
CVE-2026-128347

ExcelJS through 4.4.0 Arbitrary File Read via WorkbookWriter addImage Filename

ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Exceljs Project
Products
Exceljs