Export limit exceeded: 16042 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425868 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425868 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 12015 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 10821 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,821

Export CSV
CVE-2026-92256

Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read Handlers

NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json read handlers. Attackers can query l2tpd_config_show.cgi to expose stored IPsec PSK and RSA key material.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Netcore
Products
Nr255-v
CVE-2026-82775

Directory Listing Information Disclosure in Contec M2M Gateway and Controller

An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the directory list without authentication.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Contec
Products
M2m Controller Configurable Type Cps-mcs341* M2m Controller Integrated Type Cps-mc341 M2m Gateway Configurable Type Cps-mgs341* and 1 more
CVE-2026-82778

Unauthenticated Directory Listing Disclosure in Contec CONPROSYS PAC Series

An exposure of information through directory listing issue exists in CONPROSYS PAC Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the directory list without authentication.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Contec
Products
Configurable Type Cps-pcs341-ds1-1201 Integrated Type Cps-pc341-*-9201
CVE-2026-82786

Insufficiently Protected Credentials Lead to Sensitive Information Exposure in Contec Remote I/O Coupler Unit

Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. If this vulnerability is exploited, sensitive information may be restored from a backup file.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Contec
Products
Remote I/o Coupler Unit (server Type) Cpsn-mcb271-*
CVE-2026-61701

Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magic_links.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php without sufficient integrity protection, while an unsafe legacy unserialize() fallback remains reachable. An attacker who can manipulate database records, such as through a separate SQL injection or compromised administrative access, can insert a malicious serialized object graph containing executable closure behavior; visiting the associated magic link then deserializes the record and can execute arbitrary code in the application process. The affected path is restricted to manipulated action records and does not independently provide database-write access. This issue is fixed in version 2.25.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Cesargb
Products
Laravel-magiclink
CVE-2026-82723

Actor record with password digest stored in AshAuthentication audit log entries

Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the audit store. The audit_log add-on builds each entry's extra_data in AshAuthentication.AddOn.AuditLog.Auditor.build_extra_data/4, which takes :actor from the action callback context verbatim. Any audited action invoked with actor: set to a user record therefore deposits that record, including its hashed_password attribute, into the audit entry. The same module already collapses the audited identity to an opaque string via AshAuthentication.user_to_subject/1 and filters params against the strategy's configured allow-list, so the actor is the only stored value that reaches the audit store unfiltered. Marking the attribute sensitive?: true does not help, because that redacts inspect/1 output rather than JSON encoding or raw-term storage. There is no attacker-controlled trigger and no network disclosure path: entries accumulate from ordinary authenticated activity, and an attacker's own requests deposit only their own digest. Exploitation requires independent read access to the audit store, such as database credentials, an audit role, a backup, or a log shipper, at which point the digests support offline password attack against every active account. Whether the material persists depends on the data layer, since raw-term stores keep it verbatim while a SQL store raises Protocol.UndefinedError and drops the entry unless the user resource derives Jason.Encoder. This issue affects ash_authentication: from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.2.

CVSS 4.0 · 1.8 Low EPSS < 1% KEV · Not listed
Vendors
Team-alembic
Products
Ash Authentication
CVE-2026-81632

Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, AshAuthentication.Phoenix.Components.Password.SignInForm builds the sign_in_with_token path with the freshly issued user.__metadata__.token as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser's own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential. This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Team-alembic
Products
Ash Authentication Ash Authentication Phoenix
CVE-2026-81320

Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are typically forwarded to centralized logging systems and readable by anyone with pods/log access in the openshift-operators namespace. Debug level 1 is a low threshold commonly enabled during troubleshooting.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Hawtio
CVE-2026-84650

Jenkins Deserialization Vulnerability via Transient Fields in Configuration Updates

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Jenkins Jenkins Project
Products
Jenkins Jenkins
CVE-2026-84647

Stapler: Jenkins: Stapler: Unintended configuration object instantiation via form data binding

In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing attackers with Overall/Read permission to instantiate types related to configuration for which that field type was not intended.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Jenkins Project
Products
Jenkins
CVE-2026-75057

Plain‑Text Logging of Git Credentials in JetBrains IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Intellij Idea
CVE-2026-91992

Tornado before 6.5.7 Credential Leak via Handle Reuse

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-91982

Vikunja before 2.6.0 TOTP Secret Disclosure via API

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Go-vikunja Vikunja
Products
Vikunja Vikunja
CVE-2026-69507

Microsoft Windows Search Component Information Disclosure Vulnerability

Insertion of sensitive information into externally-accessible file or directory in Microsoft Windows Search Component allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 11 23h2 Windows 11 23h2 Windows 11 24h2 and 8 more
CVE-2026-68873

Windows Program Compatibility Assistant Service Information Disclosure Vulnerability

Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 11 23h2 Windows 11 23h2 Windows 11 24h2 and 7 more
CVE-2026-69214

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server contacted through the same CookieJar can plant a cookie for another domain, and the jar later sends that cookie to the victim domain, enabling session fixation or overwriting security-sensitive cookies. The patch validates the Set-Cookie domain against the response origin, although public-suffix rejection remains unimplemented. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Http4s
Products
Http4s
CVE-2026-85171

n8n before 1.123.73 Credential Exposure via Error Logging

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-82070

Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface

A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session with monitoring-level permissions and results in exposure of cleartext credentials that could enable impersonation of other users, including privileged accounts.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server