Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-26106
High · 8.8
CWE-20 Mar 10, 2026
Microsoft SharePoint Server Remote Code Execution Vulnerability
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-20967
High · 8.8
CWE-20 Mar 10, 2026
System Center Operations Manager (SCOM) Elevation of Privilege Vulnerability
Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network.
CVE-2026-3288
High · 8.8
CWE-20 Mar 9, 2026
ingress-nginx rewrite-target nginx configuration injection
A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
CVE-2025-14558
High · 7.2
High · 45 Public exploit CWE-20 Mar 9, 2026
Remote code execution via ND6 Router Advertisements
The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified.
resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.
CVE-2025-69279
High · 7.5
CWE-20 Mar 9, 2026
Improper Input Validation in Google Android
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
CVE-2025-69278
High · 7.5
CWE-20 Mar 9, 2026
Improper Input Validation in Google Android
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
CVE-2025-61616
High · 7.5
CWE-20 Mar 9, 2026
Improper Input Validation in Google Android
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
CVE-2025-61615
High · 7.5
CWE-20 Mar 9, 2026
Improper Input Validation in Google Android
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
CVE-2025-61614
High · 7.5
CWE-20 Mar 9, 2026
Improper Input Validation in Google Android
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
CVE-2025-61613
High · 7.5
CWE-20 Mar 9, 2026
Improper Input Validation in Google Android
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
CVE-2025-61612
High · 7.5
CWE-20 Mar 9, 2026
Improper Input Validation in Google Android
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
CVE-2025-61611
High · 7.5
CWE-20 Mar 9, 2026
Improper Input Validation in Linuxfoundation Yocto
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed..
CVE-2026-29791
Medium · 6.5
CWE-20 Mar 6, 2026
Agentgateway: Missing parameter sanitization in MCP to OpenAPI conversion
Agentgateway is an open source data plane for agentic AI connectivity within or across any agent framework or environment. Prior to version 0.12.0, when converting MCP tools/call request to OpenAPI request, input path, query, and header values are not sanitized. This issue has been patched in version 0.12.0.
CVE-2026-29046
High · 8.2
CWE-20 Mar 6, 2026
TinyWeb: HTTP Header Control Character Injection into CGI Environment
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in header lines and header values, including CR, LF, and NUL, and did not consistently defend against encoded forms such as %0d, %0a, and %00. This can enable header value confusion across parser boundaries and may create unsafe data in the CGI execution context. This issue has been patched in version 2.04.
CVE-2026-0848
Critical · 10.0
CWE-20 Mar 5, 2026
Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading
NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM.
CVE-2025-7375
Medium · 6.5
CWE-20 Mar 5, 2026
Unauthenticated Denial-of-Service Vulnerability in Omada EAP610
A denial-of-service (DoS) vulnerability was identified in Omada EAP610 v3. An attacker with adjacent network access can send crafted requests to cause the device’s HTTP service to crash. This results in temporary service unavailability until the device is rebooted.
This issue affects Omada EAP610 firmware versions prior to 1.6.0.
CVE-2025-11143
Medium · 6.5
CWE-20 Mar 5, 2026
Improper Input Validation in Eclipse Foundation Jetty
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
CVE-2025-41257
Medium · 4.8
CWE-20 Mar 4, 2026
Suprema BioStar 2 Insecure Password Change
Suprema’s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise.
CVE-2026-3545
Critical · 9.6
CWE-20 Mar 4, 2026
Improper Input Validation in Google Chrome
Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-20020
Medium · 5.7
CWE-20 Mar 4, 2026
Improper Input Validation in Cisco Adaptive Security Appliance Software
A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. If OSPF authentication is enabled, the attacker must know the secret key to exploit this vulnerability.
This vulnerability is due to insufficient input validation when processing OSPF update packets. An attacker could exploit this vulnerability by sending crafted OSPF update packets. A successful exploit could allow the attacker to create a buffer overflow, causing the affected device to reload, resulting in a DoS condition.
CVE-2026-27443
High · 7.5
CWE-20 Mar 4, 2026
S/MIME Decryption Tag Sanitization Bypass
SEPPmail Secure Email Gateway before version 15.0.1 does not properly sanitize the headers from S/MIME protected MIME entities, allowing an attacker to control trusted headers.
CVE-2026-3204
Critical · 9.8
CWE-20 Mar 3, 2026
Improper Input Validation in Devolutions Devolutions Server
Improper
input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message via a specially crafted URL.
CVE-2026-2590
Critical · 9.8
CWE-20 Mar 3, 2026
Devolutions Remote Desktop Manager: Credential Persistence in Vault Entries
Improper
enforcement of the Disable password saving in vaults setting in the
connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries,
potentially exposing sensitive information to other users, by creating
or editing certain connection types while password saving is disabled.
CVE-2024-55020
Critical · 9.8
CWE-20 Mar 3, 2026
Improper Input Validation in Weintek Easyweb
A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute arbitrary commands with root privileges.
CVE-2025-62816
Medium · 5.5
CWE-20 Mar 3, 2026
Improper Input Validation in Samsung Exynos 1280 Firmware
An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. Unvalidated VS4L_VERTEXIOC_BOOTUP input leads to a denial of service.