CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-57517

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc

PUBLISHED

Vendor: Control Web Panel
Product: Control Web Panel
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-57516

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that proc

PUBLISHED

Vendor: Anyscale, Inc
Product: Ray
Provider severity: HIGH
Conflicts: 1

CVE-2026-57511

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SMTP DATA command to add Bcc recipients for content exfiltration, forge the From address to bypass SPF and DKIM checks, or inject Content-Type and MIME boundary headers to corrupt message bodies for phishi

PUBLISHED

Vendor: superplanehq
Product: superplane
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-57510

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs without organization scoping. Attackers can read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitra

PUBLISHED

Vendor: superplanehq
Product: superplane
Provider severity: HIGH
Conflicts: 1

CVE-2026-57501

Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link to a file URL that can load with System privileges when opened through either context-menu item and bypass the content-to-file security check that blocks an ordinary click. This issue is fixed in version

PUBLISHED

Vendor: zen-browser
Product: desktop
Provider severity: NONE
Conflicts: 0

CVE-2026-5750

An insecure direct object reference (IDOR) vulnerability in the Fullstep V5 registration process allows authenticated users to access data belonging to other registered users through various vulnerable authenticated resources in the application. The vulnerable endpoints result from: '/api/suppliers/v1/suppliers//false' to list user information; and '/#/supplier-registration/supplier-registration//2' to update your user information (personal details, documents, etc.).

PUBLISHED

Vendor: Fullstep
Product: Fullstep
Provider severity: HIGH
Conflicts: 0

CVE-2026-57498

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any operation. However, multiple Livewire web UI components accept server_id and destination_uuid from URL query parameters without any team ownership validation, allowing cross-team resource deployment. This vulnerability is fixed in 4.0.0-beta.474.

PUBLISHED

Vendor: coollabsio
Product: coolify
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-57495

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a privileged effect without verifying that the sender is the operator, while a sibling handler in the same repo does. The higher-impact one: any external email routed to the bridge inbox causes the dispatcher

PUBLISHED

Vendor: agenticmail, agenticmail, agenticmail, agenticmail
Product: @agenticmail/core, @agenticmail/openclaw, @agenticmail/claudecode, @agenticmail/codex
Provider severity: HIGH
Conflicts: 1

CVE-2026-57494

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to `GET /api/agenticmail/tasks/pending?assignee=<name>`. The returned task objects include the task IDs and payloads. The same task IDs can then be used with the capability-style task mutation endpoints (`/tasks/:id/claim`, `/tasks/:id/result`, `/task

PUBLISHED

Vendor: agenticmail
Product: @agenticmail/api
Provider severity: HIGH
Conflicts: 1

CVE-2026-5749

Inadequate access control in the registration process in Fullstep V5, which could allow unauthenticated users to obtain a valid JWT token with which to interact with authenticated API resources. Successful exploitation of this vulnerability could allow an unauthenticated attacker to compromise the confidentiality of the affected resource, provided they have a valid token with which to interact with the API.

PUBLISHED

Vendor: Fullstep
Product: Fullstep
Provider severity: HIGH
Conflicts: 0

CVE-2026-57481

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.13 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber's ACL read access, because leave and enter events included the wrong object state. This issue is fixed in versions 9.9.1-alpha.13 and 8.6.83.

PUBLISHED

Vendor: parse-community
Product: parse-server
Provider severity: LOW
Conflicts: 0

CVE-2026-57480

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal query-traversal helper and block the Node.js event loop. This issue is fixed in versions 9.9.1-alpha.12 and 8.6.82.

PUBLISHED

Vendor: parse-community
Product: parse-server
Provider severity: HIGH
Conflicts: 0

CVE-2026-5748

The Text Snippets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ts` shortcode in all versions up to, and including, 0.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PUBLISHED

Vendor: snedled
Product: Text Snippets
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57476

Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.

PUBLISHED

Vendor: Deloitte
Product: AI Assist for Customer
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-57475

Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.

PUBLISHED

Vendor: Deloitte
Product: AI Assist for Customer
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-57474

Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This information could reduce an attacker’s reconnaissance effort. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.

PUBLISHED

Vendor: Deloitte
Product: AI Assist for Customer
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-57473

A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior to v3.3.0.456_26031911) due to the possibility of brute-force cracking the credentials. This issue could allow attackers on the same local network to intercept traffic between the Hub and associated cameras and compromise the credentials of connected cameras.

PUBLISHED

Vendor: Reolink
Product: Home Hub
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-5747

An out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. T

PUBLISHED

Vendor: AWS
Product: Firecracker
Provider severity: HIGH
Conflicts: 2

CVE-2026-57456

Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope's docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute

PUBLISHED

Vendor: vim
Product: vim
Provider severity: HIGH
Conflicts: 0

CVE-2026-57455

Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via soun

PUBLISHED

Vendor: vim
Product: vim
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57454

Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and length point outside the line's property data. When Vim restores or displays such a line it converts the offset into a pointer and reads the virtual text without bounds checking, causing an out-of-bounds read that can crash Vim or disclose adjacent heap memory. This vulnerability is fixed in 9.2.0679.

PUBLISHED

Vendor: vim
Product: vim
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57453

Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip archive, it builds the PowerShell command by inserting archive entry names that are quoted only for the shell, not for PowerShell. A crafted entry name can break out of the intended string context and cause PowerShell to execute arbitrary commands with the privileges of the user running Vim

PUBLISHED

Vendor: vim
Product: vim
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57452

Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.

PUBLISHED

Vendor: vim
Product: vim
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-57451

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer

PUBLISHED

Vendor: vim
Product: vim
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-5745

A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to cras

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux 8, Red Hat Hardened Images, Red Hat Enterprise Linux 9
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-57439

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0.

PUBLISHED

Vendor: gchq
Product: CyberChef
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-57438

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#do_xinclude replaced each <xi:include> in place, freeing the include node along with its children (such as <xi:fallback> and its descendants) and any namespaces declared on them. If an application had already exposed one of those nodes or namespaces to Ruby, the corresponding Ruby object was left pointing at freed memory. Using the object coul

PUBLISHED

Vendor: sparklemotion
Product: nokogiri
Provider severity: LOW
Conflicts: 0

CVE-2026-57437

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault. This is only reachable when application code constructs an XPathContext directly and lets the document become unreachable while continuing to use the con

PUBLISHED

Vendor: sparklemotion
Product: nokogiri
Provider severity: LOW
Conflicts: 0

CVE-2026-57436

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.

PUBLISHED

Vendor: sparklemotion
Product: nokogiri
Provider severity: LOW
Conflicts: 0

CVE-2026-57435

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could derefere

PUBLISHED

Vendor: sparklemotion
Product: nokogiri
Provider severity: LOW
Conflicts: 1

CVE-2026-57434

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.

PUBLISHED

Vendor: sparklemotion
Product: nokogiri
Provider severity: LOW
Conflicts: 0

CVE-2026-57433

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.

PUBLISHED

Vendor: HAARG
Product: Storable
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-57432

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of boun

PUBLISHED

Vendor: SHAY
Product: perl
Provider severity: HIGH
Conflicts: 1

CVE-2026-57431

Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions.

PUBLISHED

Vendor: Mervin Praison
Product: Featured Image
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57430

Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.

PUBLISHED

Vendor: SEOPress Free
Product: SEOPress PRO
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-5743

The SimpLy Gallery Block & Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block attributes in all versions up to, and including, 3.3.3.2. This is due to insufficient input sanitization and output escaping on the sliderMaxHeight block attribute in the pgc_sgb_render_callback() function. The vulnerability exists because the pgc_sgb_sanitize_custom_css() function uses a flawed regex pattern that only removes event handlers with quoted values (e.g., onfocus="alert()")

PUBLISHED

Vendor: gallerycreator
Product: SimpLy Gallery
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57429

Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.

PUBLISHED

Vendor: eLightUp
Product: Slim SEO
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57428

Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions.

PUBLISHED

Vendor: BoldGrid
Product: Sprout Clients
Provider severity: HIGH
Conflicts: 0

CVE-2026-57427

Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.

PUBLISHED

Vendor: Download Monitor
Product: Download Monitor - WPForms Lock
Provider severity: HIGH
Conflicts: 0

CVE-2026-57426

Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions.

PUBLISHED

Vendor: Chill Media Labs S.R.L.
Product: Modula - PRO
Provider severity: HIGH
Conflicts: 0

CVE-2026-57425

Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.

PUBLISHED

Vendor: wpdesk
Product: Autopay dla WooCommerce
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57424

Missing Authorization vulnerability in knitpay Razorpay Payment Links for WooCommerce rzp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay Payment Links for WooCommerce: from n/a through <= 2.1.4.

PUBLISHED

Vendor: knitpay
Product: Razorpay Payment Links for WooCommerce
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57423

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter allows Reflected XSS.This issue affects Message Filter for Contact Form 7: from n/a through <= 1.6.3.8.

PUBLISHED

Vendor: Kofi Mokome
Product: Message Filter for Contact Form 7
Provider severity: HIGH
Conflicts: 0

CVE-2026-57422

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Reflected XSS.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through <= 1.2.0.

PUBLISHED

Vendor: VillaTheme
Product: Bopo – WooCommerce Product Bundle Builder
Provider severity: HIGH
Conflicts: 0

CVE-2026-57421

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms crm-perks-forms allows Reflected XSS.This issue affects CRM Perks Forms: from n/a through <= 1.1.7.

PUBLISHED

Vendor: CRM Perks
Product: CRM Perks Forms
Provider severity: HIGH
Conflicts: 0

CVE-2026-57420

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Netrr Author Box WP Lens author-box-for-divi allows Stored XSS.This issue affects Author Box WP Lens: from n/a through <= 2.1.5.

PUBLISHED

Vendor: Netrr
Product: Author Box WP Lens
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-5742

The UsersWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.2.60. This is due to insufficient input sanitization of user-supplied URL fields and improper output escaping when rendering user profile data in badge widgets. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that will execute whenever a user accesses a page containing the affected badge widget.

PUBLISHED

Vendor: stiofansisland
Product: UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57419

Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Locations for WooCommerce: from n/a through <= 3.1.8.

PUBLISHED

Vendor: Fahad Mahmood
Product: Stock Locations for WooCommerce
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57418

Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.13.

PUBLISHED

Vendor: BoldGrid
Product: Client Invoicing by Sprout Invoices
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57417

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme Cart Lift cart-lift allows Stored XSS.This issue affects Cart Lift: from n/a through <= 3.1.57.

PUBLISHED

Vendor: RexTheme
Product: Cart Lift
Provider severity: HIGH
Conflicts: 0