CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-85888 HIGH · 7.7 Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- CVE-2026-85886 HIGH · 8.5 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-85876 HIGH · 7.0 Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
- CVE-2026-85473 MEDIUM · 5.3 The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition…
- CVE-2026-83966 HIGH · 7.8 Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation…
- CVE-2026-83965 HIGH · 7.8 Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.…
- CVE-2026-83945 MEDIUM · 6.6 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-83661 HIGH · 7.8 Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user.…
- CVE-2026-79715 MEDIUM · 5.5 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a…
- CVE-2026-78633 MEDIUM · 6.5 The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop…
- CVE-2026-78632 MEDIUM · 5.3 The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICEALL SERVICES and CREATOR OWNER security principals on the directories containing the agent…
- CVE-2026-78628 MEDIUM · 6.0 The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and…
- CVE-2026-77816 MEDIUM · 6.5 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.
- CVE-2026-76001 HIGH · 7.1 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain…
- CVE-2026-75996 HIGH · 7.5 ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources,…
- CVE-2026-75995 HIGH · 8.4 ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker…
- CVE-2026-75994 CRITICAL · 9.6 ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could…
- CVE-2026-75748 HIGH · 7.6 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability…
- CVE-2026-71385 HIGH · 8.4 ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with…
- CVE-2026-70189 MEDIUM · 6.7 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
- CVE-2026-68883 HIGH · 8.5 Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-67628 MEDIUM · 4.9 Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- CVE-2026-67626 MEDIUM · 6.5 Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network.
- CVE-2026-67625 HIGH · 8.5 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-65674 HIGH · 8.8 Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-63171 MEDIUM · 5.4 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category…
- CVE-2026-63169 MEDIUM · 6.4 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier…
- CVE-2026-63168 MEDIUM · 5.4 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional…
- CVE-2026-63157 MEDIUM · 5.4 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address…
- CVE-2026-63156 MEDIUM · 6.1 Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter,…
- CVE-2026-62840 HIGH · 7.0 Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2026-49950 CRITICAL · 9.8 Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP…
- CVE-2026-34634 HIGH · 8.6 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction.…
- CVE-2026-34633 HIGH · 7.7 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain…
- CVE-2026-19810 MEDIUM · 5.4 Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be susceptible to a Cross-Site Scripting (XSS) vulnerability, which is a type of issue…
- CVE-2026-14909 MEDIUM · 6.5 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information…
- CVE-2026-14532 MEDIUM · 4.3 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.
- CVE-2026-11713 MEDIUM · 5.4 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled.
- CVE-2026-108388 LOW · 3.5 Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when…
- CVE-2026-107371 MEDIUM · 5.4 When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against…
- CVE-2026-107370 MEDIUM · 5.3 When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET…
- CVE-2026-107369 MEDIUM · 6.1 The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it…
- CVE-2026-106624 CRITICAL · 10.0 ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of…
- CVE-2026-106623 HIGH · 7.5 ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive…
- CVE-2026-106622 CRITICAL · 10.0 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction.…
- CVE-2026-106621 CRITICAL · 9.1 ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of…
- CVE-2026-106620 CRITICAL · 9.6 ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass…
- CVE-2026-106619 CRITICAL · 9.0 ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker…
- CVE-2026-106618 HIGH · 8.8 ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker…
- CVE-2026-106617 HIGH · 8.8 ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker…