CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-98436 HIGH · 7.8 In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Disable device buffer exporting Device buffers are never intended to be exported. Disable exporting…
- CVE-2026-111932 LOW · 3.4 Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance…
- CVE-2026-111934 LOW · 3.7 Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended…
- CVE-2026-111933 LOW · 3.7 Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived…
- CVE-2026-111927 HIGH · 7.7 Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern…
- CVE-2025-71435 MEDIUM · 4.2 Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is…
- CVE-2026-89096 MEDIUM · 5.9 A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an…
- CVE-2026-89088 MEDIUM · 5.5 A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user…
- CVE-2026-89085 MEDIUM · 6.6 A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error…
- CVE-2026-17591 LOW · 3.6 A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which…
- CVE-2026-111802 MEDIUM · 6.6 A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash…
- CVE-2026-62438 MEDIUM · 6.1 A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user…
- CVE-2026-62439 HIGH · 7.0 A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a…
- CVE-2026-85977 MEDIUM · 5.3 A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses…
- CVE-2026-85231 MEDIUM · 6.5 A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure…
- CVE-2026-17491 MEDIUM · 5.4 IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory… Ibm
- CVE-2026-17488 MEDIUM · 4.3 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Ibm
- CVE-2026-17275 LOW · 3.7 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied… Ibm
- CVE-2026-17073 MEDIUM · 5.4 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution. Ibm
- CVE-2026-17068 MEDIUM · 5.4 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version… Ibm
- CVE-2026-107674 MEDIUM · 5.1 IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting… Ibm
- CVE-2026-102917 HIGH · 7.8 IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform… Ibm
- CVE-2026-89098 MEDIUM · 5.5 A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify…
- CVE-2026-111693 CRITICAL · 9.8 DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can…
- CVE-2026-111683 MEDIUM · 5.4 Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views…
- CVE-2026-111678 LOW · 3.3 Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded.… Antiword Project
- CVE-2026-111668 MEDIUM · 5.4 AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query…
- CVE-2026-111663 HIGH · 8.6 Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit…
- CVE-2026-111658 LOW · 3.8 SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs.…
- CVE-2026-111653 MEDIUM · 5.3 53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise…
- CVE-2026-111648 LOW · 2.7 BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers…
- CVE-2026-111643 CRITICAL · 9.8 Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint.…
- CVE-2026-111638 HIGH · 7.7 sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private…
- CVE-2026-111633 HIGH · 8.6 ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key…
- CVE-2026-111628 MEDIUM · 5.0 10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers…
- CVE-2026-111623 MEDIUM · 5.6 Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address.…
- CVE-2026-111618 MEDIUM · 5.3 CoAI (Chat Nio) tot en met versie 4.0.0 bevat een kwetsbaarheid voor path traversal zonder authenticatie in de endpoints voor het genereren en downloaden van…
- CVE-2026-111613 HIGH · 7.5 AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to…
- CVE-2026-111608 MEDIUM · 4.2 Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership…
- CVE-2026-111603 MEDIUM · 4.3 PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check.…
- CVE-2026-57487 HIGH · 7.5 pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to… Pupnp Project
- CVE-2026-57486 HIGH · 7.5 pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix,… Pupnp Project
- CVE-2026-55862 MEDIUM · 6.5 pupnp is een SDK voor de ontwikkeling van UPnP-toepassingen voor apparaten en controlepunten. Voorafgaand aan 2.0.0 verwerken meerdere IXML DOM traversal-functies diep genest XML met… Pupnp Project
- CVE-2026-111581 LOW · 3.3 A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities…
- CVE-2026-110806 MEDIUM · 6.5 Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the… Devolutions
- CVE-2026-110805 LOW · 2.6 Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret… Devolutions
- CVE-2026-110804 MEDIUM · 4.3 Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to… Devolutions
- CVE-2026-110287 MEDIUM · 4.3 Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission… Devolutions
- CVE-2026-111555 MEDIUM · 6.0 A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect…
- CVE-2026-105958 HIGH · 7.5 A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client…