CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-26464

Stored Cross-Site Scripting (XSS) was found in the /admin/edit_user.php page of Society Management System Portal V1.0, which allows remote attackers to inject and store arbitrary JavaScript code that is executed in users' browsers. This vulnerability can be exploited via the name parameter in a POST HTTP request, leading to execution of malicious scripts when the affected content is viewed by other users, including administrators.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-26462

Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration. The application enables Node.js integration while disabling context isolation, allowing JavaScript executed in the renderer process to access Node.js APIs and execute arbitrary operating system commands.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-26461

A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execute arbitrary commands via a crafted web request.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-26460

A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplied input in the tabid parameter of the DashBoardTab view (getTabContents action), allowing an attacker to inject arbitrary HTML content into the dashboard interface. The injected content is rendered in the victim's browser

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-2646

A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and corrupt heap memory. A maliciously crafted session would need to be loaded from an external source to trigger this vulnerability. Internal sessions were not vulnerable.

PUBLISHED

Vendor: wolfssl
Product: wolfssl
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-2645

In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the CertificateVerify message before the ClientKeyExchange message had been received. This issue affects wolfSSL before 5.8.4 (wolfSSL 5.8.2 and earlier is vulnerable, 5.8.4 is not vulnerable). In 5.8.4 wolfSSL would detect the issue later in the handshake. 5.9.0 was further hardened to catch the issue earlier in the handshake.

PUBLISHED

Vendor: wolfSSL
Product: wolfSSL
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-2644

A weakness has been identified in niklasso minisat up to 2.2.0. This issue affects the function Solver::value in the library core/SolverTypes.h of the component DIMACS File Parser. This manipulation of the argument variable index with the input 2147483648 causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet

PUBLISHED

Vendor: niklasso
Product: minisat
Provider severity: LOW, MEDIUM
Conflicts: 2

CVE-2026-26422

clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation.

PUBLISHED

Vendor: Clash Verge Rev
Product: clash-verge-service-ipc
Provider severity: HIGH
Conflicts: 0

CVE-2026-2642

A security vulnerability has been detected in ggreer the_silver_searcher up to 2.2.0. The impacted element is the function search_stream of the file src/search.c. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

PUBLISHED

Vendor: ggreer
Product: the_silver_searcher
Provider severity: LOW, MEDIUM
Conflicts: 2

CVE-2026-26418

Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-26417

A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-26416

An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privileges across role boundaries via crafted requests.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-2641

A weakness has been identified in universal-ctags ctags up to 6.2.1. The affected element is the function parseExpression/parseExprList of the file parsers/v.c of the component V Language Parser. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

PUBLISHED

Vendor: universal-ctags
Product: ctags
Provider severity: LOW, MEDIUM
Conflicts: 2

CVE-2026-2640

During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticated user to terminate privileged processes.

PUBLISHED

Vendor: Lenovo
Product: PC Manager
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-26399

A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function allocates a TIM_HandleTypeDef structure on the stack and passes its address to HAL initialization routines, where it is stored in a global timer handle registry. After the function returns, interrupt service routines may dereference this dangling pointer, resulting in memory corruption.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-26396

OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py. The input parameter “filename” is user-controllable and is concatenated into the file path to be read without proper validation, leading to a directory traversal vulnerability that may result in sensitive information disclosure.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-2638

A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption.

PUBLISHED

Vendor: X-VPN
Product: X-VPN macOS website
Provider severity: HIGH
Conflicts: 0

CVE-2026-26379

Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration. This allows authenticated attackers to perform internal network scanning and identify running services by analyzing server response times.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-26378

Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file upload function in Invoice features

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-26377

Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via the News function.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-26370

WordPress Plugin "Survey Maker" versions 5.1.7.7 and prior contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.

PUBLISHED

Vendor: Ays Pro
Product: Survey Maker
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-2637

iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes an NSConnection service that runs as root without implementing any authentication or authorization checks. This issue affects iBoysoft NTFS: 8.0.0.

PUBLISHED

Vendor: iBoysoft
Product: iBoysoft NTFS
Provider severity: HIGH
Conflicts: 0

CVE-2026-26369

eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their account to the UG_ADMIN group, bypassing intended access controls and gaining administrative capabilities such as modifying device configurations, network settings, and other smart home system functions.

PUBLISHED

Vendor: JUNG
Product: eNet SMART HOME server
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-26368

eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated low-privileged user (UG_USER) to reset the password of arbitrary accounts, including those in the UG_ADMIN and UG_SUPER_ADMIN groups, without supplying the current password or having sufficient privileges. By sending a crafted JSON-RPC request to /jsonrpc/management, an attacker can overwrite existing credentials, resulting in direct account

PUBLISHED

Vendor: JUNG
Product: eNet SMART HOME server
Provider severity: HIGH
Conflicts: 1

CVE-2026-26367

eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-privileged user (UG_USER) to delete arbitrary user accounts, except for the built-in admin account. The application does not enforce role-based access control on this function, allowing a standard user to submit a crafted POST request to /jsonrpc/management specifying another username to have that account removed without elevated permis

PUBLISHED

Vendor: JUNG
Product: eNet SMART HOME server
Provider severity: HIGH
Conflicts: 1

CVE-2026-26366

eNet SMART HOME server 2.2.1 and 2.3.1 ships with default credentials (user:user, admin:admin) that remain active after installation and commissioning without enforcing a mandatory password change. Unauthenticated attackers can use these default credentials to gain administrative access to sensitive smart home configuration and control functions.

PUBLISHED

Vendor: JUNG
Product: eNet SMART HOME server
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-26365

Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" could result in a forward request with invalid message framing, depending on the Akamai processing path. This could result in the origin server parsing the request body incorrectly, leading to HTTP request smuggling.

PUBLISHED

Vendor: Akamai
Product: Ghost
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-26362

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized modification of critical system files.

PUBLISHED

Vendor: Dell, Dell
Product: Unisphere for PowerMax, PowerMax
Provider severity: HIGH
Conflicts: 1

CVE-2026-26361

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

PUBLISHED

Vendor: Dell, Dell
Product: PowerMax, Unisphere for PowerMax
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-26360

PUBLISHED

Vendor: Dell, Dell
Product: Unisphere for PowerMax, PowerMax
Provider severity: HIGH
Conflicts: 1

CVE-2026-2636

This vulnerability is caused by a CWE‑159: "Improper Handling of Invalid Use of Special Elements" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash. Microsoft silently fixed this vulnerability in the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025. Windows 25H2 (released in September) was released with the patch. Window

PUBLISHED

Vendor: Microsoft
Product: Windows OS
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-26359

PUBLISHED

Vendor: Dell, Dell
Product: PowerMax, Unisphere for PowerMax
Provider severity: HIGH
Conflicts: 1

CVE-2026-26358

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

PUBLISHED

Vendor: Dell, Dell
Product: Unisphere for PowerMax, PowerMax
Provider severity: HIGH
Conflicts: 1

CVE-2026-26357

Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.

PUBLISHED

Vendor: Dell, Dell
Product: Unisphere for PowerMax Virtual Appliance 9.2.4.17, Unisphere for PowerMax 9.2.4.18
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-26355

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special Elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.

PUBLISHED

Vendor: Dell
Product: PowerProtect Data Domain
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-26354

Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.60, contain a stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.

PUBLISHED

Vendor: Dell
Product: PowerProtect Data Domain
Provider severity: HIGH
Conflicts: 0

CVE-2026-26352

Smoothwall Express versions prior to 3.1 Update 13 contain a stored cross-site scripting vulnerability in the /cgi-bin/vpnmain.cgi script due to improper sanitation of the VPN_IP parameter. Authenticated attackers can inject arbitrary JavaScript through VPN configuration settings that executes when the affected page is viewed by other users.

PUBLISHED

Vendor: Smoothwall
Product: Express
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-26351

GetSimpleCMS Community Edition (CE) versions prior to 3.3.22 (3.3.16 tested) contains a stored cross-site scripting (XSS) vulnerability in the Theme to Components functionality within components.php. User-supplied input provided to the "slug" field of a component is stored without proper output encoding. While other fields are sanitized using safe_slash_html(), the slug parameter is written to XML and later rendered in the administrative interface without sanitation, resulting in persistent exec

PUBLISHED

Vendor: GetSimpleCMS-CE
Product: GetSimpleCMS-CE
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-2635

A flaw was found in MLflow. A remote attacker can exploit this vulnerability by leveraging hard-coded default credentials present in the basic_auth.ini file. This allows the attacker to bypass authentication and execute arbitrary code in the context of the mlflow python application.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, MLflow
Product: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), MLflow
Provider severity: CRITICAL, HIGH
Conflicts: 3

CVE-2026-26345

SPIP before 4.4.8 contains a stored cross-site scripting (XSS) vulnerability in the public area triggered in certain edge-case usage patterns. The echapper_html_suspect() function does not adequately sanitize user-controlled content, allowing authenticated users with content-editing privileges (e.g., author-level roles and above) to inject malicious scripts. The injected payload may be rendered across multiple pages within the framework and execute in the browser context of other users, includin

PUBLISHED

Vendor: SPIP
Product: SPIP
Provider severity: HIGH, MEDIUM
Conflicts: 1

CVE-2026-26342

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expiration. An attacker who obtains a valid token (for example via interception, log exposure, or token reuse on a shared system) can continue to authenticate to the management interface until the token is revoked, enabling unauthorized access to device functions and data.

PUBLISHED

Vendor: Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l.
Product: Tolling+, ANPR Mobile, Vega53, Smart+, Vega11, Vega33, Basic MK2, Axle Counter, Smart+ Traffic Light, Smart+ Speed
Provider severity: HIGH
Conflicts: 1

CVE-2026-26341

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning. An attacker who can reach the management interface can authenticate using the default credentials and gain administrative access, enabling unauthorized access to device configuration and data.

PUBLISHED

Vendor: Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l.
Product: Tolling+, Smart+ Traffic Light, Basic MK2, Smart+ Speed, Vega11, Axle Counter, Vega33, Smart+, Vega53, ANPR Mobile
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-26340

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.

PUBLISHED

Vendor: Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l., Tattile s.r.l.
Product: ANPR Mobile, Vega33, Smart+ Traffic Light, Vega53, Tolling+, Basic MK2, Axle Counter, Smart+, Vega11, Smart+ Speed
Provider severity: HIGH
Conflicts: 1

CVE-2026-2634

Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains. This vulnerability was fixed in Firefox for iOS 147.4.

PUBLISHED

Vendor: Mozilla
Product: Firefox for iOS
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-26339

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which exists in the document processing functionality.

PUBLISHED

Vendor: Hyland, Hyland
Product: Alfresco Transformation Service (Enterprise), Alfresco Community (Transform Core)
Provider severity: CRITICAL
Conflicts: 2

CVE-2026-26338

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery (SSRF) through the document processing functionality.

PUBLISHED

Vendor: Hyland, Hyland
Product: Alfresco Transformation Service (Enterprise), Alfresco Community (Transform Core)
Provider severity: CRITICAL, MEDIUM
Conflicts: 2

CVE-2026-26337

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve both arbitrary file read and server-side request forgery through the absolute path traversal.

PUBLISHED

Vendor: Hyland, Hyland
Product: Alfresco Transformation Service (Enterprise), Alfresco Community (Transform Core)
Provider severity: HIGH
Conflicts: 2

CVE-2026-26336

Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files.

PUBLISHED

Vendor: Hyland, Hyland
Product: Alfresco Community, Alfresco Enterprise
Provider severity: HIGH
Conflicts: 2

CVE-2026-26335

Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a valid ASP.NET ViewState payload that passes integrity validation and is accepted by the application, resulting in server-side deserialization and remote code execution in the context of the IIS application.

PUBLISHED

Vendor: Calero
Product: VeraSMART
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-26334

Calero VeraSMART versions prior to 2026 R1 contain hardcoded static AES encryption keys within Veramark.Framework.dll (Veramark.Core.Config class). These keys are used to encrypt the password of the service account stored in C:\\VeraSMART Data\\app.settings. An attacker with local access to the system can extract the hardcoded keys from the Veramark.Framework.dll module and decrypt the stored credentials. The recovered credentials can then be used to authenticate to the Windows host, potentially

PUBLISHED

Vendor: Calero
Product: VeraSMART
Provider severity: HIGH
Conflicts: 0