Export limit exceeded: 425959 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Expected end of text, found ':' (at char 28), (line:1, col:29)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,959

Export CSV
CVE-2026-61637

Icinga Web 2: Open redirect on login page, under certain circumstances

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from en_US. This issue has been patched in versions 2.12.7 and 2.13.1.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Icinga
Products
Icinga Web 2
CVE-2026-57739

WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through 10.11.0.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Acymailing Newsletter Team Wordpress
Products
Acymailing Smtp Newsletter Wordpress
CVE-2026-123962

Unauthorized Local File Access via Symlinked authorized_keys in FreedomBox (pre-26.15)

In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys file to be a symlink. NOTE: FreedomBox is a Debian Pure Blend, which means that it distributes its software through Debian repositories.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Debian
Products
Freedombox
CVE-2026-125796

WordPress JS Help Desk plugin <= 5.0.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 5.0.5.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-125818

WordPress wpDiscuz plugin <= 7.6.75 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.75.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-125823

WordPress Gutenverse plugin <= 4.2.2 - Denial of Service Attack vulnerability

Allocation of Resources Without Limits or Throttling vulnerability in Jegstudio Gutenverse gutenverse allows HTTP DoS.This issue affects Gutenverse: from n/a through 4.2.2.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-125826

WordPress PowerPress Podcasting plugin <= 11.18.3 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Path Traversal.This issue affects PowerPress Podcasting: from n/a through 11.18.3.

CVSS 3.1 · 5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-125760

WordPress Bit Assist plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bit Apps Bit Assist bit-assist allows DOM-Based XSS.This issue affects Bit Assist: from n/a through 1.8.4.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-125830

WordPress belingoGeo plugin <= 1.13.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Belingo belingoGeo belingogeo allows Reflected XSS.This issue affects belingoGeo: from n/a through 1.13.3.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-125804

WordPress AI Engine plugin <= 3.9.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meow Apps AI Engine ai-engine allows Stored XSS.This issue affects AI Engine: from n/a through 3.9.3.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-125822

WordPress WordPress File Upload plugin <= 5.2.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.3.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-125817

WordPress Feedzy plugin <= 5.2.15 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Feedzy feedzy-rss-feeds allows Stored XSS.This issue affects Feedzy: from n/a through 5.2.15.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-129091

WordPress GrandPrix Core plugin <= 1.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes GrandPrix Core grandprix-core allows PHP Local File Inclusion.This issue affects GrandPrix Core: from n/a through 1.0.

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-125798

WordPress Smart Online Order for Clover plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zaytech Smart Online Order for Clover clover-online-orders allows DOM-Based XSS.This issue affects Smart Online Order for Clover: from n/a through 1.6.6.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-129456

frr: bgpd use-after-free of Tunnel Encapsulation sub-TLVs via the attribute intern reuse cache with soft-reconfiguration inbound

In FRRouting, bgpd frees the sub-TLV chain of a Tunnel Encapsulation attribute (type 23) while routes stored by bgpd still point to it, if the attribute is received from a neighbor that has "soft-reconfiguration inbound" configured. A cache added to speed up attribute interning while processing the prefixes of an UPDATE checks whether an interned attribute set may be reused by comparing the parsed attributes with themselves, so the check always succeeds. Interning the parsed attributes for the Adj-RIB-In removes the Tunnel Encapsulation sub-TLVs from them, and the copy that bgpd then interns for the route reuses the cached attribute set, which still holds the sub-TLVs, without taking a reference on them. When the route is later replaced, withdrawn or cleared, for example when the session goes down, the sub-TLV chain is freed while still in use, and bgpd then reads it, decrements a reference count inside it and frees it a second time. In the reporter's build without AddressSanitizer this ended in an assertion failure in bgpd's memory accounting, aborting bgpd and dropping all BGP sessions on the router, and the neighbor can repeat it each time bgpd restarts. Because freed heap memory is written to and freed again, consequences beyond a crash cannot be ruled out. An established BGP session is required, and the attribute does not need to be malformed. bgpd processes attribute 23 from every neighbor, including eBGP neighbors, unless it is explicitly discarded, although RFC 9012 requires it to be filtered on eBGP sessions by default. Neighbors without "soft-reconfiguration inbound" are not affected.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Frrouting
Products
Frrouting
CVE-2025-71470

MicroQuickJS before commit 99eed3f Out-of-Bounds Read in build_backtrace

MicroQuickJS (mquickjs) before commit 99eed3f contains an out-of-bounds read vulnerability because JS_Call() raises exceptions during frame setup without updating ctx->sp and ctx->fp. Attackers can supply JavaScript that calls a non-function value, causing build_backtrace() to walk stale frame pointers and crash the engine for denial of service.

CVSS 4.0 · 6.8 Medium EPSS n/a KEV · Not listed
Vendors
Bellard
Products
Mquickjs
CVE-2026-125795

WordPress Estatik plugin <= 4.3.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This issue affects Estatik: from n/a through 4.3.6.

CVSS 3.1 · 9.8 Critical EPSS n/a KEV · Not listed
Vendors
Estatik Wordpress-extensions
Products
Estatik Estatik
CVE-2026-129485

Kroki before 0.36.0 SSRF via BlockDiag Icon and Background Attributes

Kroki before 0.36.0 contains a server-side request forgery vulnerability in the BlockDiag family of engines that allows unauthenticated attackers to make server requests via node icon and background attributes. Attackers can send crafted diagrams to POST /blockdiag/svg or sibling endpoints to query internal services or cloud metadata and read local image files from the server.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
Yuzutech
Products
Kroki
CVE-2026-129484

Kroki before 0.36.0 Reflected XSS via /goat/svg Color Scheme Options

Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via unvalidated svg-color-dark-scheme and svg-color-light-scheme options. Attackers can craft a GET /goat/svg URL whose option value closes the SVG style element, executing JavaScript in the Kroki origin when victims open it.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Yuzutech
Products
Kroki