Vulnerabilities

Aggregated CVE / GHSA / KEV / OSV — filter by tag and category.

KEV

Categories

All 🌐 Web Application 🧭 Browser 🖥️ Operating System 📱 Mobile 🛰️ Network Infrastructure ☁️ Cloud / Container 📝 CMS / Site Builder 🗄️ Database / Storage 🔐 Auth / Identity 🔑 Cryptography 🛠️ DevOps / CI-CD 🤖 AI / ML 🔌 IoT / Embedded 🧩 Hardware / Firmware 🏢 Enterprise SaaS 🧰 Developer Tooling ☠️ Malicious Package 📦 Other

Tag groups

All 💬 Programming Languages 22 🧱 Web Frameworks 29 📱 Mobile Platforms 6 🤖 AI/ML Frameworks 11 🖥️ Web Servers 9 🗄️ Databases 13 📝 CMS 9 ☁️ Cloud Platforms 11 📦 Container Tech 12 🖥️ Operating Systems 15 ⚔️ Attack Types 25 🧬 CWE 185 🏢 Vendors 581 📦 Products 666 🌳 Package Ecosystems 24 🛠️ DevOps Tools 17 📡 Protocols 15

Popular tags (Top 40)

Rootio Linux419 Microsoft386 C237 Java183 Jre178 Java Min178 Bitnami178 Windows177 Rootdebian11175 Rootdebian12151 Linux130 Cwe 20125 Cwe 78120 Linux Kernel106 Cwe 787105 Apple99 Cwe 41699 Cwe 2296 Rootdebian1393 Cwe 11990 Cisco89 Denial of Service85 Cwe 9484 Multiple Products79 Adobe78 Google77 Cwe 50270 Cwe 7966 Cwe 8954 Apache47 Cwe 91844 Cwe 28443 Oracle42 Cwe 28741 JavaScript41 PHP41 Cwe 7740 Chromium V838 Cwe 30638 Cwe 84337

Filtering: Group: attack-types Clear

ID	Title	Severity	Tags	Detected
CVE-2026-1185	Vulnerability in privilege-escalation (CVE-2026-1185) vulnerability in privilege-escalation (CVE-2026-1185). Risk of unauthorized operations or information disclosure.	Medium	Privilege Escalation Cwe 732 Axis Axis Os	3 months ago
CVE-2026-7287	Vulnerability in dos (CVE-2026-7287) vulnerability in dos (CVE-2026-7287). Risk of unauthorized operations or information disclosure.	High	Denial of Service Cwe 120 Zyxel Nwa1100 N Firmware +1	3 months ago
CVE-2026-45430	Cross-Site Request Forgery (CSRF) in csrf (CVE-2026-45430) vulnerability in csrf (CVE-2026-45430). Confidential information can be exposed externally.	High	Cross-Site Request Forgery Cwe 352	3 months ago
CVE-2026-40131	SQL Injection in sqli (CVE-2026-40131) SQL injection in sqli (CVE-2026-40131). Risk of unauthorized operations or information disclosure.	Low	SQL Injection Cwe 89	3 months ago
CVE-2026-34260	SQL Injection in sqli (CVE-2026-34260) SQL injection in sqli (CVE-2026-34260). Confidential information can be exposed externally.	Critical	SQL Injection Cwe 89	3 months ago
CVE-2026-27682	Cross-Site Scripting (XSS) in sap (CVE-2026-27682) cross-site scripting in sap (CVE-2026-27682). Risk of unauthorized operations or information disclosure.	Medium	Cross-Site Scripting Cwe 79 Sap Netweaver Application Server Abap	3 months ago
CVE-2026-0502	Cross-Site Request Forgery (CSRF) in csrf (CVE-2026-0502) vulnerability in csrf (CVE-2026-0502). Risk of unauthorized operations or information disclosure.	Medium	Cross-Site Request Forgery Cwe 352	3 months ago
CVE-2026-22796	Vulnerability in jvn (CVE-2026-22796) vulnerability in jvn (CVE-2026-22796). Risk of unauthorized operations or information disclosure.	Medium	Jvn Japan Jpcert Denial of Service +2	3 months ago
CVE-2026-45392	Reserved. Details will be published at disclosure. Reserved. Details will be published at disclosure.	High	Cwe 20 JavaScript Cross-Site Scripting Cwe 79	3 months ago
CVE-2026-43899	Vulnerability in CVE-2026-43899 (CVE-2026-43899) vulnerability in CVE-2026-43899 (CVE-2026-43899). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `1.0.4-beta.1` or later.	Critical	Remote Code Execution Cwe 20	3 months ago
CVE-2026-43900	Cross-Site Scripting (XSS) in vue (CVE-2026-43900) cross-site scripting in vue (CVE-2026-43900). Confidential information can be exposed externally. Mitigation: upgrade to `1.0.4-beta.1` or later.	Critical	JavaScript Vue.js Cross-Site Scripting Cwe 79	3 months ago
CVE-2026-42554	Cross-Site Scripting (XSS) in github.com/gofiber/fiber/v3 (CVE-2026-42554) cross-site scripting in github.com/gofiber/fiber/v3 (CVE-2026-42554). Risk of unauthorized operations or information disclosure. Exploitable via ``DefaultRes.AutoFormat``. Mitigation: upgrade to `3.2.0` or later.	Medium	JavaScript Cross-Site Scripting Cwe 79 Gofiber +1	3 months ago
CVE-2026-43893	Vulnerability in exiftool-vendored (CVE-2026-43893) vulnerability in exiftool-vendored (CVE-2026-43893). Data can be tampered with by attackers. Exploitable via ``WriteTask``. Mitigation: upgrade to `35.19.0` or later.	High	JavaScript Remote Code Execution Cwe 88	3 months ago
CVE-2026-43884	SSRF (Server-Side Request Forgery) in wwbn/avideo (CVE-2026-43884) SSRF in wwbn/avideo (CVE-2026-43884). Confidential information can be exposed externally. Exploitable via `POST /plugin/AI/receiveAsync.json.php`.	High	PHP Server-Side Request Forgery Cwe 918	3 months ago
CVE-2026-43879	SSRF (Server-Side Request Forgery) in wwbn/avideo (CVE-2026-43879) SSRF in wwbn/avideo (CVE-2026-43879). Risk of unauthorized operations or information disclosure. Exploitable via `POST /internal/admin/action`.	Medium	PHP Server-Side Request Forgery Cwe 918	3 months ago
CVE-2026-43877	Cross-Site Request Forgery (CSRF) in wwbn/avideo (CVE-2026-43877) vulnerability in wwbn/avideo (CVE-2026-43877). Risk of unauthorized operations or information disclosure. Exploitable via ``autoCSRFGuard``.	Medium	PHP Cross-Site Request Forgery Cwe 352	3 months ago
CVE-2026-43880	Vulnerability in wwbn/avideo (CVE-2026-43880) vulnerability in wwbn/avideo (CVE-2026-43880). Risk of unauthorized operations or information disclosure. Exploitable via `POST /objects/sendEmail.json.php`.	Medium	PHP Cross-Site Request Forgery Cwe 940	3 months ago
CVE-2026-42046	Vulnerability in CVE-2026-42046 (CVE-2026-42046) vulnerability in CVE-2026-42046 (CVE-2026-42046). Successful exploitation can lead to full system takeover.	High	Remote Code Execution Cwe 122 Cwe 190 Cwe 787	3 months ago
CVE-2026-42188	SSRF (Server-Side Request Forgery) in org.geysermc.geyser:core (CVE-2026-42188) SSRF in org.geysermc.geyser:core (CVE-2026-42188). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `2.9.3` or later.	Low	Java Server-Side Request Forgery Cwe 918 Geysermc +1	3 months ago
CVE-2026-42564	Path Traversal in path-traversal (CVE-2026-42564) path traversal in path-traversal (CVE-2026-42564). Confidential information can be exposed externally. Mitigation: upgrade to `1.22.0` or later.	High	Path Traversal Cwe 22 Cwe 200	3 months ago
CVE-2026-42600	Path Traversal in github.com/minio/minio (CVE-2026-42600) path traversal in github.com/minio/minio (CVE-2026-42600). Confidential information can be exposed externally. Exploitable via ``ReadMultiple``.	Medium	Path Traversal Cwe 22 Minio	3 months ago
CVE-2026-28983	Vulnerability in dos (CVE-2026-28983) vulnerability in dos (CVE-2026-28983). Risk of unauthorized operations or information disclosure.	High	Denial of Service Cwe 843 Apple Ipados +5	3 months ago
CVE-2026-28908	Vulnerability in dos (CVE-2026-28908) vulnerability in dos (CVE-2026-28908). Risk of unauthorized operations or information disclosure.	High	Denial of Service Cwe 400 Apple macOS	3 months ago
CVE-2026-41489	Vulnerability in privilege-escalation (CVE-2026-41489) vulnerability in privilege-escalation (CVE-2026-41489). Successful exploitation can lead to full system takeover.	High	Privilege Escalation Cwe 15 Cwe 269 Cwe 732	3 months ago
CVE-2026-8321	A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function... A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function...	High	Authentication Bypass Cwe 287 Cwe 288 TypeScript	3 months ago
CVE-2026-45026	Cross-Site Scripting (XSS) in CVE-2026-45026 (CVE-2026-45026) cross-site scripting in CVE-2026-45026 (CVE-2026-45026). Confidential information can be exposed externally. Mitigation: upgrade to `3.7.3` or later.	Medium	PHP JavaScript Cross-Site Scripting Cwe 79	3 months ago
CVE-2026-45025	Cross-Site Scripting (XSS) in CVE-2026-45025 (CVE-2026-45025) cross-site scripting in CVE-2026-45025 (CVE-2026-45025). Confidential information can be exposed externally. Mitigation: upgrade to `3.7.3` or later.	Medium	PHP JavaScript Cross-Site Scripting Cwe 79	3 months ago
CVE-2026-42887	Cross-Site Scripting (XSS) in CVE-2026-42887 (CVE-2026-42887) cross-site scripting in CVE-2026-42887 (CVE-2026-42887). Confidential information can be exposed externally. Mitigation: upgrade to `2.33.0` or later.	Medium	JavaScript Cross-Site Scripting Cwe 79	3 months ago
CVE-2026-42882	Path Traversal in github.com/oxyno-zeta/s3-proxy (CVE-2026-42882) path traversal in github.com/oxyno-zeta/s3-proxy (CVE-2026-42882). Confidential information can be exposed externally. Exploitable via `PUT /upload/foo/drafts/../restricted/`. Mitigation: upgrade to `0.0.0-20260424211602-1320e4abd46a` or later.	Critical	Path Traversal Authentication Bypass Cwe 22 Cwe 863	3 months ago
CVE-2026-42870	Cross-Site Scripting (XSS) in CVE-2026-42870 (CVE-2026-42870) cross-site scripting in CVE-2026-42870 (CVE-2026-42870). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `3.7.0` or later.		PHP Cross-Site Scripting Cwe 79	3 months ago
CVE-2026-42872	Cross-Site Scripting (XSS) in CVE-2026-42872 (CVE-2026-42872) cross-site scripting in CVE-2026-42872 (CVE-2026-42872). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `3.7.0` or later.	Medium	PHP JavaScript Cross-Site Scripting Cwe 79	3 months ago
CVE-2026-42874	Vulnerability in microdot (CVE-2026-42874) vulnerability in microdot (CVE-2026-42874). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `2.6.1` or later.	Low	Python Cross-Site Scripting Cwe 113	3 months ago
CVE-2026-2614	MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem	High	Cwe 22 MLflow Remote Code Execution Lfprojects	3 months ago
CVE-2026-44657	Cross-Site Scripting (XSS) in mantisbt/mantisbt (CVE-2026-44657) cross-site scripting in mantisbt/mantisbt (CVE-2026-44657). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `2.28.2` or later.		PHP JavaScript Cross-Site Request Forgery Cwe 79	3 months ago
CVE-2026-43979	Cross-Site Scripting (XSS) in local-deep-research (CVE-2026-43979) cross-site scripting in local-deep-research (CVE-2026-43979). Risk of unauthorized operations or information disclosure. Exploitable via `POST /api/start_research`. Mitigation: upgrade to `1.6.0` or later.	Medium	Server-Side Request Forgery Cwe 79 Cwe 918	3 months ago
CVE-2026-41149	Code Injection in mermaid (CVE-2026-41149) code injection in mermaid (CVE-2026-41149). Risk of unauthorized operations or information disclosure. Exploitable via ``classDef``. Mitigation: upgrade to `10.9.6` or later.		JavaScript Cross-Site Scripting Cwe 94	3 months ago
CVE-2026-40607	Cross-Site Scripting (XSS) in mantisbt/mantisbt (CVE-2026-40607) cross-site scripting in mantisbt/mantisbt (CVE-2026-40607). Risk of unauthorized operations or information disclosure. Exploitable via ``g_stored_query_create_threshold``. Mitigation: upgrade to `2.28.2` or later.		Cross-Site Scripting Cwe 79	3 months ago
CVE-2026-40598	Cross-Site Scripting (XSS) in mantisbt/mantisbt (CVE-2026-40598) cross-site scripting in mantisbt/mantisbt (CVE-2026-40598). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `2.28.2` or later.		Cross-Site Scripting Cwe 79	3 months ago
CVE-2026-40597	Vulnerability in mantisbt/mantisbt (CVE-2026-40597) vulnerability in mantisbt/mantisbt (CVE-2026-40597). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `2.28.2` or later.		PHP JavaScript Cross-Site Scripting Cwe 79 +1	3 months ago
CVE-2026-40596	Cross-Site Scripting (XSS) in mantisbt/mantisbt (CVE-2026-40596) cross-site scripting in mantisbt/mantisbt (CVE-2026-40596). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `2.28.2` or later.		Cross-Site Scripting Cwe 79	3 months ago
CVE-2026-39850	Vulnerability in yiisoft/yii2 (CVE-2026-39850) vulnerability in yiisoft/yii2 (CVE-2026-39850). Confidential information can be exposed externally. Exploitable via ``require``. Mitigation: upgrade to `2.0.55` or later.	High	PHP Remote Code Execution Cwe 20 Cwe 98	3 months ago
CVE-2026-34463	Cross-Site Scripting (XSS) in mantisbt/mantisbt (CVE-2026-34463) cross-site scripting in mantisbt/mantisbt (CVE-2026-34463). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `2.28.2` or later.		PHP Cross-Site Scripting Cwe 79	3 months ago
CVE-2026-34390	Vulnerability in mantisbt/mantisbt (CVE-2026-34390) vulnerability in mantisbt/mantisbt (CVE-2026-34390). Risk of unauthorized operations or information disclosure. Exploitable via `PUT /project/{id}/users`. Mitigation: upgrade to `2.28.2` or later.		PHP Privilege Escalation Cwe 284	3 months ago
CVE-2026-7790	Vulnerability in cowlib (CVE-2026-7790) vulnerability in cowlib (CVE-2026-7790). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `2.16.1` or later.		Denial of Service Cwe 400	3 months ago
CVE-2026-45224	Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution	High	Path Traversal Cwe 22	3 months ago
CVE-2026-45223	Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user... Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user...	High	C Authentication Bypass Cwe 290	3 months ago
CVE-2026-43968	Vulnerability in cowlib (CVE-2026-43968) vulnerability in cowlib (CVE-2026-43968). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `2.16.1` or later.	Medium	Cross-Site Scripting Cwe 93 Ninenines Cowlib	3 months ago
CVE-2026-45000	SSRF (Server-Side Request Forgery) in openclaw (CVE-2026-45000) SSRF in openclaw (CVE-2026-45000). Risk of unauthorized operations or information disclosure. Exploitable via ``openclaw``. Mitigation: upgrade to `2026.4.20` or later.	Medium	Server-Side Request Forgery Cwe 918 Openclaw	3 months ago
CVE-2026-45001	Vulnerability in openclaw (CVE-2026-45001) vulnerability in openclaw (CVE-2026-45001). Data can be tampered with by attackers. Exploitable via ``openclaw``. Mitigation: upgrade to `2026.4.20` or later.	High	Server-Side Request Forgery Cwe 862 Openclaw	3 months ago
CVE-2026-4890	Vulnerability in dos (CVE-2026-4890) vulnerability in dos (CVE-2026-4890). Risk of unauthorized operations or information disclosure.	High	Denial of Service Cwe 835	3 months ago

Vulnerabilities

🍪 About cookies