Export limit exceeded: 16307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 10820 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,820

Export CSV
CVE-2026-107608

Improper link resolution in asset bundling output handling in aws-cdk-lib

Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or later.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Aws-cdk-lib
CVE-2020-11619

jackson-databind: Serialization gadgets in org.springframework:spring-aop

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

CVSS 3.1 · 8.1 High EPSS 3.7% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Active Iq Unified Manager and 28 more
CVE-2026-13046

Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os
CVE-2026-93447

Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with the privileges of the service process.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm Langflow
Products
Langflow Oss Langflow
CVE-2026-105833

EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP credentials and access the victim's mailbox.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Espocrm
Products
Espocrm
CVE-2026-101331

Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ibm Langflow
Products
Langflow Oss Langflow
CVE-2026-72817

go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Go-chi
Products
Chi
CVE-2026-100846

MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization

MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution in the context of the application.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Project-monai
Products
Monai
CVE-2026-107578

Improper Link Resolution Before File Access ('Link Following') in hMailServer

Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows, operations run with administrator rights by the installer, DBSetup, the Control Panel or an administrator wrote log entries and crash records into the log folder, created, deleted and changed the permissions of the self-signed certificate and private key in the data folder, and rewrote message files in the data folder, all by path in folders the service account (NT SERVICE\hMailServer, the default for new installations since 6.3.4) can modify, following junctions and mount points; and the store-maintenance operations reached files by names taken from the database, which the service account can write, including names outside the data folder. On Linux, the store-maintenance and object-storage operations run as root followed symbolic links the service account (the packaged hmailserver user, which owns the data folder) planted in it, so a root-run operation read, wrote or removed the link's target as root. A local attacker controlling the service account can thereby gain the administrator's (Windows) or root's (Linux) privileges when such an operation is run.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Progressive Robot
Products
Hmailserver
CVE-2026-102135

Kiteworks Email Protection Gateway Deserialization of Untrusted Data

On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execution as the gateway service account. Replication is disabled by default, and exploitation requires control of a trusted cluster peer or administrative access to the appliance.

CVSS 3.1 · 6.6 Medium EPSS 1.3% KEV · Not listed
Vendors
Accellion Kiteworks
Products
Kiteworks Kiteworks Email Protection Gateway
CVE-2026-102108

Kiteworks Email Protection Gateway deserialization of untrusted data

An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account. Exploitation requires an administrator account holding a specific queue-management privilege.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Accellion Kiteworks
Products
Kiteworks Kiteworks Email Protection Gateway
CVE-2026-17637

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm Redhat
Products
Financial Transaction Manager Financial Transaction Manager (ftm) for Redhat Openshift Financial Transaction Manager Ftmfor Redhat Openshift and 1 more
CVE-2026-17643

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm Redhat
Products
Financial Transaction Manager Financial Transaction Manager (ftm) for Redhat Openshift Financial Transaction Manager Ftmfor Redhat Openshift and 1 more
CVE-2026-12544

Foreman: ssti and insecure deserialization in foreman-rake configuration

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Enterprise Linux Satellite Satellite Capsule and 2 more
CVE-2026-105763

Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL

Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords, because the field was not hidden and the lookup did not enforce the calling user's identity or account visibility. A normal workspace member could obtain other members' external-service credentials and use them to access mail or calendars and potentially reset third-party accounts. Google and Microsoft OAuth-only workspaces were not affected. This issue is fixed in version 2.7.0.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Twenty
Products
Twenty
CVE-2026-105752

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation prefix in the global unsalted cache namespace even when the caller enabled salting. On deployments with prefix caching enabled, which is the default, an authenticated tenant who can reconstruct a victim's low-entropy post-tool history can submit the same continuation and use the cached_tokens_per_turn count to determine whether the prefix was previously processed, defeating the intended tenant isolation of salted prefix caching. This issue is fixed in version 0.30.0.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Vllm Vllm-project
Products
Vllm Vllm
CVE-2020-9547

jackson-databind: Serialization gadgets in ibatis-sqlmap

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

CVSS 3.1 · 9.8 Critical EPSS 18.4% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Active Iq Unified Manager and 25 more
CVE-2026-103877

Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements

Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java class, allowing some potential RCE.  This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Directory Ldap Api