CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-107424 CRITICAL · 9.8 Onjuiste kwetsbaarheid voor Privilege-toewijzing in M A Vinoth Kumar Frontend Dashboard frontend-dashboard maakt Privilege-escalatie mogelijk. Dit probleem heeft invloed op Frontend Dashboard: van n.v.t. tot…
- CVE-2026-107422 MEDIUM · 6.5 Onjuiste neutralisatie van invoer tijdens het genereren van webpagina's ('Cross-site Scripting') kwetsbaarheid in axew3.com WP w3all phpBB wp-w3all-phpbb-integratie maakt opgeslagen XSS mogelijk. Dit probleem heeft…
- CVE-2026-107421 HIGH · 7.3 Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2.
- CVE-2026-107417 MEDIUM · 6.5 Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification…
- CVE-2026-106599 HIGH · 8.8 Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.
- CVE-2026-105874 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through…
- CVE-2026-85298 NONE Een kwetsbaarheid voor onjuiste autorisatie in de AuthConfig-validatie- en integratieruntime in Google Cloud Application Integration-versies vóór 2026-08-27 stelt een geverifieerde gebruiker in staat om privileges…
- CVE-2026-76655 HIGH · 7.5 A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution
- CVE-2026-73798 HIGH · 8.2 A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service.
- CVE-2026-73797 MEDIUM · 5.3 A security vulnerability in HPE NonStop TSQLFIL may cause address space corruption when a specific API is called.
- CVE-2026-97315 MEDIUM · 5.4 The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to…
- CVE-2026-88998 MEDIUM · 5.3 The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order…
- CVE-2026-88842 LOW · 3.3 A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in…
- CVE-2026-82844 MEDIUM · 5.3 The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal…
- CVE-2026-73796 MEDIUM · 4.4 A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query.
- CVE-2026-73795 MEDIUM · 6.4 Een beveiligingslek in HPE NonStop TMF Auditread2 kan een denial-of-serviceaanval veroorzaken.
- CVE-2026-108072 NONE Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient…
- CVE-2026-108071 NONE Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification…
- CVE-2026-108070 NONE A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by…
- CVE-2026-107913 NONE Rejected reason: This CVE ID is a duplicate of CVE-2026-39749 and was never published. Both IDs were assigned to the same Broken Access Control vulnerability…
- CVE-2026-107431 HIGH · 7.5 Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.
- CVE-2026-105067 HIGH · 8.5 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue…
- CVE-2026-104795 HIGH · 8.8 The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. **fork()s** a…
- CVE-2026-103905 HIGH · 7.5 The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user…
- CVE-2026-103904 CRITICAL · 9.3 The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored…
- CVE-2026-103358 HIGH · 7.5 Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer…
- CVE-2026-103308 MEDIUM · 6.5 The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that…
- CVE-2026-101341 NONE Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA…
- CVE-2026-101339 NONE A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite…
- CVE-2026-101338 NONE When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once…
- CVE-2026-101337 NONE When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to…
- CVE-2026-101301 MEDIUM · 5.3 The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode,…
- CVE-2026-100229 MEDIUM · 6.5 A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field…
- CVE-2026-90954 HIGH · 7.8 A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and…
- CVE-2026-88829 HIGH · 7.2 A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend…
- CVE-2026-86476 HIGH · 8.4 A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and…
- CVE-2026-73794 MEDIUM · 4.6 HPE NonStop MODULAR NSJ contains a predictable seed vulnerability in Random Number Generation (PRNG)
- CVE-2026-73793 HIGH · 7.9 HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.
- CVE-2026-73792 LOW · 3.8 A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow.
- CVE-2026-73791 LOW · 2.0 A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow.
- CVE-2026-109971 MEDIUM · 4.7 A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it…
- CVE-2026-109970 MEDIUM · 4.7 A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive…
- CVE-2026-109969 MEDIUM · 4.7 Er is een fout gevonden in de gaffel PKCS#11 pin. De clevis-pkcs11-afunix-socket-unlock daemon maakt AF_UNIX-sockets aan zonder expliciete toestemmingsbeperkingen of verificatie van peer credentials. Onder…
- CVE-2026-100231 MEDIUM · 6.1 A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters outside the Basic Multilingual…
- CVE-2026-73790 HIGH · 8.2 Een kwetsbaarheid in HPE NonStop iTP WebServer kan leiden tot geheugenbeschadiging en het afsluiten van het systeem.
- CVE-2026-14851 NONE A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data –…
- CVE-2026-107428 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat…
- CVE-2026-103671 MEDIUM · 4.7 External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to…
- CVE-2026-92392 NONE During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct…
- CVE-2026-110284 HIGH · 7.5 The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and…