Export limit exceeded: 16307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 10820 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 11141 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11,141

Export CSV
CVE-2026-91348

Oracle Solaris 11.3/11.4 Logon Exploitation Resulting in System Compromise

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Solaris
CVE-2026-87049

operator-foundry: operator-foundry: Over-permissive GITHUB_TOKEN and GCP WIF secrets granted to third-party reusable workflow on untrusted-triggerable events

A flaw was found in operator-foundry. Untrusted external actors can exploit over-permissive GitHub access tokens and Google Cloud Platform (GCP) Workload Identity Federation credentials granted to a third-party reusable workflow. By invoking this workflow on untrusted-triggerable events without sufficient authorization checks, an attacker could gain highly privileged access to GitHub and cloud resources, potentially leading to unauthorized control.

CVSS 3.1 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Operator-foundry
Products
Operator-foundry
CVE-2026-73974

linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test() treated the first or second element of a --test CSV argument as a filesystem path and returned the file contents as simulated standard output or standard error without path confinement. The hidden but production-accessible --test argument was accepted by sudo-authorized plugins, so an attacker controlling the nagios or icinga account could use check-plugins/deb-updates/deb-updates with its default QUERY=1 to disclose every line of a root-readable file. Approximately 22 other plugins exposed filtered content or a root file existence and readability oracle through the same helper, while check-plugins/network-bonding/network-bonding and check-plugins/openstack-swift-stat/openstack-swift-stat had direct read paths that bypassed the helper. The library fix confines fixture reads to the invoking plugin's unit-test directory and refuses unsafe anchors, and the plugin fix routes the two bypasses through that helper. These issues are fixed in linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linuxfabrik
Products
Lib Monitoring-plugins
CVE-2026-95743

Local Privilege Escalation Vulnerabilities in HPE Networking Fabric Composer

Local privilege escalation vulnerabilities exist in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with low privileges to gain elevated privileges on the affected system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Fabric Composer Fabric Composer
CVE-2026-95768

Privilege Escalation Leading to Information Disclosure in HPE Networking Fabric Composer API

A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated low-privileged remote attacker to obtain sensitive information from the affected system.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Fabric Composer Fabric Composer
CVE-2026-123064

WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation

The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-0016

Local Information Disclosure via Cross‑User Settings Override in Android CredentialManagerService

In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-95747

Privilege Escalation in the SSH Interface of HPE Networking Fabric Composer

A privilege escalation vulnerability exists in the SSH interface of HPE Networking Fabric Composer which could allow an authenticated low-privileged attacker to exceed their authorized level of access, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to internal services of the affected system.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Fabric Composer Fabric Composer
CVE-2026-77439

Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints

Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting themselves, an editor can take ownership of the album, remove the original owner, and delete the album. This vulnerability is fixed in version 3.0.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Immich-app
Products
Immich
CVE-2026-54382

VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access

VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being restricted to their own folder. Attackers can overwrite other users' objects in the shared S3 bucket using credentials obtained via CVE-2026-54378, destroying original content without triggering deletion protections.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Shenzhen Shine Industrial
Products
Vitafit
CVE-2026-122302

Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check

Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeting other namespaces or cluster-scoped kinds, making the background controller create or clone resources cluster-wide.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2026-122016

yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges management

A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2. This issue affects the function SysPermissionService.getMenuPermission of the file SysPermissionService.java of the component Permission Service. This manipulation of the argument perms causes improper privilege management. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yangzongzhuan
Products
Ruoyi-vue
CVE-2026-110633

MyReport Updater through 2.1.1 Local Privilege Escalation via Updater Service

MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Report One
Products
Myreport Updater
CVE-2026-95737

Local Privilege Escalation in HPE Networking Fabric Composer

A privilege escalation vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with high privileges to gain elevated privileges on the underlying host operating system.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Fabric Composer Fabric Composer
CVE-2026-95752

Local Privilege Escalation in HPE Networking Fabric Composer

A local privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to elevate their privileges on the affected system.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Fabric Composer Fabric Composer
CVE-2026-124621

kongxin-github Java_Library_Management_System Swing UI Layer MainInterface.java Landing.sureadmin improper authorization

A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Book.modifybook/Book.deletebook/Category.addcategory/Category.setcategory/Landing.sureadmin of the file src/view/MainInterface.java of the component Swing UI Layer. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Kongxin-github
Products
Java Library Management System
CVE-2026-121843

Privilege escalation in Firefox for iOS

Privilege escalation in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox For Ios
CVE-2026-121419

SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision

SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-119506

WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-95753

Privilege Escalation in HPE Networking Fabric Composer API

A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to disclose network traffic from switches managed by Fabric Composer.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Fabric Composer Fabric Composer