CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-86955 MEDIUM · 5.5 An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to… Apple
- CVE-2026-86914 MEDIUM · 5.5 An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7.… Apple
- CVE-2026-86907 MEDIUM · 4.4 An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app with admin privileges… Apple
- CVE-2026-86871 MEDIUM · 5.9 An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An… Apple
- CVE-2026-86868 CRITICAL · 9.1 An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An… Apple
- CVE-2026-84579 HIGH · 8.8 A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Opening a… Apple
- CVE-2026-84547 LOW · 3.5 A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7.… Apple
- CVE-2026-84508 MEDIUM · 5.5 This issue was addressed with improved validation of the caller's access. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27,… Apple
- CVE-2026-84490 LOW · 2.0 This issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to a… Apple
- CVE-2026-65396 MEDIUM · 5.5 A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An… Apple
- CVE-2026-65379 MEDIUM · 5.5 The issue was addressed with improved handling of secure input state. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe… Apple
- CVE-2026-65372 MEDIUM · 4.7 A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious… Apple
- CVE-2026-65356 MEDIUM · 5.5 An access issue was addressed with improved access controls. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An… Apple
- CVE-2026-28853 HIGH · 7.8 The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate… Apple
- CVE-2026-8355 MEDIUM · 5.4 IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform… Ibm
- CVE-2026-107366 HIGH · 8.3 IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message… Langflow
- CVE-2026-110936 CRITICAL · 9.5 Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a… Siemens
- CVE-2026-106931 CRITICAL · 9.5 EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or… Eg Secure Solutions
- CVE-2026-96656 CRITICAL · 9.5 Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may… Plex
- CVE-2026-96655 CRITICAL · 9.5 Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the… Plex
- CVE-2026-96654 CRITICAL · 9.5 Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins'… Plex
- CVE-2026-96652 CRITICAL · 9.5 Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in… Plex
- CVE-2026-77684 MEDIUM · 5.7 The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on hf->tx_pending when the RFCOMM…
- CVE-2026-19595 MEDIUM · 6.1 The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with K_SYSCALL_MEMORY_READ() rather than K_SYSCALL_MEMORY_WRITE(). Both are pure out-parameters: z_impl_rtio_cqe_get_mempool_buffer()…
- CVE-2026-112261 HIGH · 7.8 A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free…
- CVE-2026-112258 HIGH · 7.8 A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed…
- CVE-2026-112257 HIGH · 7.8 A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify…
- CVE-2026-76788 HIGH · 8.8 The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. For the REPLY_KEYPPAD and REPLY_RAW…
- CVE-2026-76787 MEDIUM · 5.9 The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_probe() (subsys/mgmt/updatehub/updatehub.c). The decoder treats every descriptor field as optional —…
- CVE-2026-112391 HIGH · 7.5 Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows… Python
- CVE-2026-112390 HIGH · 7.5 Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image.… Python
- CVE-2026-112778 HIGH · 8.8 Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares,… Traefik
- CVE-2026-112260 HIGH · 7.1 A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data…
- CVE-2026-112259 MEDIUM · 5.5 A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting…
- CVE-2026-6719 HIGH · 7.5 IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Ibm Linux
- CVE-2026-4418 MEDIUM · 5.4 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would… Ibm
- CVE-2026-3295 HIGH · 7.4 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before… Ibm
- CVE-2026-3161 MEDIUM · 5.9 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Ibm
- CVE-2026-4413 MEDIUM · 6.1 IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI… Ibm Linux
- CVE-2026-4405 MEDIUM · 4.0 IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system. Ibm Linux
- CVE-2026-3628 MEDIUM · 5.3 IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions. Ibm Linux
- CVE-2026-3303 LOW · 3.7 IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is… Ibm Linux
- CVE-2026-1510 MEDIUM · 4.7 IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection. Ibm Linux
- CVE-2026-1501 LOW · 3.7 IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation. Ibm Linux
- CVE-2023-38375 MEDIUM · 6.1 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… Ibm
- CVE-2026-6930 LOW · 3.7 IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Ibm Linux
- CVE-2026-15661 MEDIUM · 5.3 IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written… Ibm Linux
- CVE-2026-14511 MEDIUM · 6.5 IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming… Ibm
- CVE-2026-12727 MEDIUM · 4.3 IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names. Ibm
- CVE-2026-12670 MEDIUM · 5.3 IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character… Ibm