Export limit exceeded: 425880 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Expected end of text, found 'én' (at char 17), (line:1, col:18)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,880

Export CSV
CVE-2026-62974

BACnet Stack: Remote unauthenticated DoS in `Life_Safety_Zone` `PROP_ZONE_MEMBERS` WriteProperty parsing

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a malformed but non-empty BACnet WriteProperty request can drive the official server demo into a non-terminating request-processing loop with repeated heap-backed side effects. This results in a remote unauthenticated denial of service via uncontrolled resource consumption and a non-terminating request path. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack
CVE-2026-63150

Omnispace Agora Project 26.10.0 CSRF via Administrator Account Creation

Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link or auto-navigating page that issues a plain GET request, exploiting the lack of CSRF protection and SameSite=Lax cookie behavior on top-level navigations to create unauthorized administrator accounts.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-82102

DataStage on Cloud Pak for Data has vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-91868

IBM Security QRadar EDR Improper Access Control

IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Qradar Edr
CVE-2026-91869

IBM Security QRadar EDR Improper Restriction of Excessive Authentication Attempts

IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to bypass security restrictions due to improper rate limiting on TOTP verification.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Qradar Edr
CVE-2026-109158

IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Insertion of Sensitive Information into Log File

IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sensitive information about the deployed environment within error messages.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
App Connect Enterprise Certified Containers Operands App Connect Operator
CVE-2026-114468

IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Hard-coded Credentials

IBM App Connect Operator and App Connect Enterprise Certified Containers Operands could allow an attacker with the ability to run HTTP calls within the running container to can make administrative calls to a running IntegrationRuntime.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
App Connect Enterprise Certified Containers Operands App Connect Operator
CVE-2026-59578

AV1 Encoder Non‑Heap Buffer Overflow Leading to Local Privilege Escalation

In s_check_valid_tile_param_custom_tile of av1_encoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59582

Integer Overflow in UcePublishManager Leading to Remote Denial of Service

In StartTimer of UcePublishManager.cpp, there is a possible way to trigger a process abort during timer calculation due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59593

AV1 Decoder Heap Buffer Overflow Enables Local Privilege Escalation

In tile_info of av1_decoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59603

Double Free in Android Message Transport Service Leading to Remote Denial of Service

In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger a double free and process abort during message retry handling due to a use after free. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-59625

Out‑of‑Bounds Write in Android Texture Management Enables Remote Code Execution

In GetTwiddledMiptreeSparsePageMap of texmgmt.c, there is a possible way to trigger an out of bounds write due to a logic error. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-63167

Omnispace Agora Project 26.10.0 SQL Injection via personsSort Session Value

Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can submit an error-based extractvalue payload through personsSort to leak database information, such as the MariaDB version, via the user and space listing pages.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-129166

Keep 0.34.10 through 0.55.0 Blind SQL Injection via CEL Bracket-Indexed JSON Keys

Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts bracket-indexed JSON keys from CEL filters unescaped into JSON path expressions for SQLite, PostgreSQL, and MySQL. Authenticated users with read:alert permission can submit crafted CEL expressions to /alerts/query or the cel parameter of /incidents, using result counts as a boolean oracle to extract other tenants' alerts and password hashes.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Keephq
Products
Keep
CVE-2026-129139

paicoding commit b8206b9 through 903adce Predictable ZSXQ Account Credentials

paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the victim's /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Itwanger
Products
Paicoding
CVE-2026-128084

sqlite3-ruby: SQL Query Truncation

sqlite3 provides Ruby bindings for the SQLite3 embedded database. Prior to 2.10.2, sqlite3-ruby casts Ruby string lengths to int before passing SQL through Database#prepare, bound String or Blob values through Statement#bind_param, and String or Blob results from Ruby-defined SQL functions and aggregates through Database#create_function and Database#create_aggregate. On 64-bit platforms, a string of 4 GiB (2^32 bytes) or larger can wrap the length so SQLite processes only a prefix. A truncated SQL string can drop trailing clauses such as a WHERE condition, while a truncated bound value matters only when the application validated the full value before binding it. Exploitation requires the application and server to accept and retain the unusually large attacker-controlled string. If a dropped SQL clause contained a bind placeholder, binding raises SQLite3::RangeException instead of running the query. This issue is fixed in version 2.10.2.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sparklemotion
Products
Sqlite3-ruby
CVE-2026-127214

Flowise 3.1.4 SSRF Bypass via Custom Function Sandbox

Flowise through 3.1.4 contains a server-side request forgery vulnerability that allows authenticated attackers with chatflows or agentflows create/update permissions to bypass the Custom Function sandbox's SSRF protection by requiring a module subpath inside an allowlisted package, such as axios/dist/node/axios.cjs or node-fetch/lib/index.js, which evades the vm2 mock table and returns an unwrapped HTTP client that skips the checkDenyList validation. Attackers can issue arbitrary GET and POST requests with attacker-controlled bodies via POST /api/v1/node-custom-function to reach loopback and internal-network addresses or the cloud metadata endpoint, enabling network mapping, credential disclosure, and state changes on internal services.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Flowiseai
Products
Flowise
CVE-2026-128122

SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 4.7.0 until versions 7.2.10 and 8.0.2, @sveltejs/adapter-cloudflare allowed an attacker-influenced link crawled during prerendering to place whitespace, control characters, wildcards, or placeholders into a prerendered redirect path. The adapter wrote those paths into the Cloudflare _redirects output without output-context validation, allowing a path to create unintended routing rules that could redirect or expose requests beyond the intended prerendered route. This issue is fixed in 7.2.10 and 8.0.2.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Svelte
Products
Kit
CVE-2026-128124

AIOHTTP: Event loop stall in add_domain() wildcard matching

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Application.add_domain() converts every asterisk wildcard in a domain mask into a greedy regular-expression fragment, so a mask containing two or more wildcards can take polynomial time to reject a long Host header that does not match. A remote attacker can repeatedly send such headers to a server configured with a multi-wildcard domain mask and stall the event loop. This issue is fixed in version 3.14.4.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Aio-libs
Products
Aiohttp