Export limit exceeded: 425713 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Expected end of text, found '/' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,713

Export CSV
CVE-2026-126378

Vvveb through 1.0.8.6 Webshell Upload via Theme Installer validFile() Bypass

Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos() instead of strict path matching. Attackers with admin credentials can upload a ZIP containing a PHP file whose path includes /theme.php to achieve remote code execution on nginx deployments.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Givanz Vvveb
Products
Vvveb Vvveb
CVE-2026-126377

Vvveb before 1.0.9.0 Cookie Forgery via PHP Type Juggling in generateCookie()

Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that uses loose comparison to validate MD5 cookie hashes. Unauthenticated attackers can brute-force cookie values until the server's MD5 computation yields a 0e magic hash, then forge persistent cookies for account takeover.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Givanz Vvveb
Products
Vvveb Vvveb
CVE-2026-126373

Vvveb 1.0.8.4 through 1.0.8.6 Authorization Bypass via Post Revisions

Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets low-privileged Authors read other authors' revisions. Attackers can supply a post_id, language_id, and created_at timestamp to retrieve private unpublished drafts, because the revision() action lacks the admin_id ownership restriction.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Givanz Vvveb
Products
Vvveb Vvveb
CVE-2026-126371

Vvveb through 1.0.8.6 SQL Injection via Admin_Auth_TokenSQL::update() Array Keys

Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates admin_auth_token array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can submit backtick-containing keys to the admin/auth-token save action to inject comments and column identifiers into the SQL statement.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Givanz Vvveb
Products
Vvveb Vvveb
CVE-2026-126320

Dockhand before 1.0.55 Improper Authorization via Container File Download Endpoint

Dockhand before 1.0.55 contains an improper authorization vulnerability that lets users holding only containers:view download arbitrary container files instead of requiring containers:exec. Authenticated Enterprise RBAC users can request any path from the files/download endpoint, which reads through Docker's archive API, to retrieve secrets, keys, and mounted credentials.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Finsys
Products
Dockhand
CVE-2026-128078

GLPI: Unexpected access to followups/tasks/solutions generated from templates

GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated users could access ITIL followups, tasks, or solutions generated from templates without a read-permission check on the parent ticket, problem, or change. Depending on the template configuration, this could reveal information from parent items the user could not otherwise read. This issue is fixed in versions 10.0.27 and 11.0.9.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128077

Nuxt: Incomplete fix for CVE-2026-119200: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, Nuxt parses a request path beginning with // as a URL host before rendering a page, while Nitro server/middleware and routeRules continue to evaluate the original path. An unauthenticated request such as //x/admin can therefore resolve to the /admin page without route-scoped serverHandlers, server/middleware path checks, redirects, or security headers configured for /admin. API handlers in server/api and server/routes, appMiddleware, page middleware are unaffected. This issue is fixed in version 4.6.4.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128076

Nuxt: Colliding island props can share one `/__nuxt_island` path (incomplete fix for CVE-2026-46342)

Nuxt is an open-source web development framework for Vue.js. From 3.21.6 to before 4.0.0 and from 4.4.6 until 4.6.4, the /__nuxt_island path hash uses ohash serialization that does not escape quotes in string values or delimiters in object keys, allowing different island-prop tuples to produce the same path. For prerendering, substituted content is written into the generated page only if the crawler reaches a colliding URL before rendering the page with the legitimate props. Separately, a CDN or reverse proxy that keys island responses by path alone can be primed with the colliding response. If the substituted prop reaches v-html, innerHTML, or another unsafe HTML sink, the response can execute script in the application origin; otherwise the impact is content substitution. Applications that do not use server components or NuxtIsland, islands without attacker-influenced string props, and responses not cached by path alone are unaffected. This issue is fixed in version 4.6.4.

CVSS 3.1 · 3.1 Low EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128075

Nuxt exposes the message and data of unhandled errors thrown during server rendering

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.4, Nuxt wraps non-HTTP errors thrown during server rendering with createError and incorrectly treats the result as an error deliberately exposed by the application. In production, the error page payload (__NUXT_DATA__) and JSON error response can therefore disclose the original message and data, including an upstream $fetch URL, query-string secrets, response bodies, database hosts, or similar sensitive details, regardless of what a custom error.vue renders. Errors deliberately created with createError or showError, errors returned by useFetch or useAsyncData, and server/api routes are not affected because their client-visible behavior is intentional or follows a different path. This issue is fixed in version 4.6.4.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128074

Nuxt payload URL generation has quadratic cost for repeated slashes in the request path

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, _payload.json URL generation and the experimental early-404 path use a trailing-slash regular expression whose work grows quadratically with a long run of slash characters. An unauthenticated request can synchronously occupy the Node.js event loop and delay other requests when server-side rendering uses isr, swr, or cache route rules, or when experimental.early404 is enabled. Applications without those route rules and without experimental.early404, fully prerendered applications, and client-only applications are unaffected; the impact is limited to availability. This issue is fixed in version 4.6.4.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126848

chromium-browser: chromium-browser: Uninitialized resource in Skia

Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-126850

chromium-browser: chromium-browser: Incorrect authorization in SiteIsolation

Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android Chrome
CVE-2026-126853

chromium-browser: Chromium: Information disclosure via uninitialized resource in Skia

Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome