CVE-database
125.649 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-122048 HIGH · 7.3 Er werd een kwetsbaarheid geïdentificeerd in Campcodes Division Regional Athletic Meet Game Result Matrix System tot 2.1. Dit beïnvloedt een onbekende functie van het bestand…
- CVE-2026-122047 HIGH · 7.3 Er is een beveiligingsprobleem gedetecteerd in Campcodes Complete Advance Loan Management System 1.0. Dit heeft invloed op de functie move_uploaded_file van het bestand /lening/applicatie/banner.php. Een…
- CVE-2026-122038 HIGH · 7.3 Er werd een kwetsbaarheid geïdentificeerd in het krupalshah EmployeeRecruitmentSystem tot 922ff6d208278282e7c8e36d70d9ae356adec9fe. Beïnvloed door dit probleem is de functie mysql_query van de bestandsbron/reqformprocessing.php van de component…
- CVE-2026-122028 MEDIUM · 4.3 Er is een kwetsbaarheid gevonden in NST Labs Tech Nstbrowser 1.21.0. Beïnvloed door deze kwetsbaarheid is een onbekende functionaliteit van het bestand /agent/info van de…
- CVE-2026-115770 CRITICAL · 9.6 Pocket ID is een OIDC-provider waarmee gebruikers zich kunnen verifiëren met hun sleutels voor services. Van 2.2.0 tot 2.12.0 gebruikt SendEmailVerification het tokenmodel in backend/internal/model/email_verification_token.go…
- CVE-2026-108387 NONE radare2 is een UNIX-achtig reverse engineering-framework en opdrachtregel-toolset. Voorafgaand aan 6.2.2 konden door aanvallers gecontroleerde gegevens van verschillende plug-ins in binair formaat RBinInfo- >bclassbereiken. Het…
- CVE-2026-102337 NONE Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download…
- CVE-2026-97693 CRITICAL · 9.9 Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes…
- CVE-2026-76893 NONE tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every…
- CVE-2026-63655 HIGH · 7.5 tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in…
- CVE-2026-58128 MEDIUM · 6.2 Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a co-resident malicious application to write attacker-controlled files outside the intended…
- CVE-2026-57567 HIGH · 8.6 Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10,…
- CVE-2026-57566 CRITICAL · 9.3 Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in…
- CVE-2026-57565 MEDIUM · 6.5 Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an…
- CVE-2026-57562 MEDIUM · 6.5 Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted…
- CVE-2026-55368 HIGH · 8.1 h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer…
- CVE-2026-55367 HIGH · 7.5 h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with…
- CVE-2026-54380 MEDIUM · 5.4 VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the…
- CVE-2026-54379 NONE Reden van afwijzing: deze CVE-ID is afgewezen of ingetrokken door de CVE-nummeringsinstantie.
- CVE-2026-54378 CRITICAL · 9.6 VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST…
- CVE-2026-54377 MEDIUM · 6.5 VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different…
- CVE-2026-54376 HIGH · 8.2 VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering…
- CVE-2026-54375 HIGH · 8.4 VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted m_session_id tokens stored in application…
- CVE-2026-54374 HIGH · 7.5 VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers…
- CVE-2026-54373 LOW · 3.5 VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the…
- CVE-2026-54372 HIGH · 8.8 VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting…
- CVE-2026-122266 HIGH · 8.7 Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user…
- CVE-2026-122020 MEDIUM · 4.3 A security flaw has been discovered in NST Labs Tech Nstbrowser up to 1.2.1. The affected element is the function stopAllBrowsers of the file /api/agent/browser/stopAll…
- CVE-2026-122019 HIGH · 7.3 A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation…
- CVE-2026-122016 MEDIUM · 6.3 A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2. This issue affects the function SysPermissionService.getMenuPermission of the file SysPermissionService.java of the component Permission Service.…
- CVE-2026-122015 MEDIUM · 6.3 A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get_mlx_response of the file npcpy/gen/response.py of the component MLX Provider.…
- CVE-2026-121751 LOW · 3.1 Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, `nvm ls-remote` (and other commands that…
- CVE-2026-121750 LOW · 3.1 Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, `nvm_download_artifact` downloads a release archive directly…
- CVE-2026-121749 LOW · 3.3 Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed…
- CVE-2026-121748 LOW · 3.6 Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's `.npmrc` sets `prefix`,…
- CVE-2026-121747 MEDIUM · 5.5 Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether `.nvmrc`…
- CVE-2026-121746 MEDIUM · 5.5 Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, `nvm use --save` and `nvm install…
- CVE-2026-121745 LOW · 2.5 Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes…
- CVE-2026-115473 MEDIUM · 6.5 Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least…
- CVE-2026-103002 HIGH · 8.8 GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests…
- CVE-2026-102895 CRITICAL · 9.8 GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request…
- CVE-2026-102894 CRITICAL · 9.1 GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML,…
- CVE-2026-102280 NONE Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_FILE_SET_ATTRIBUTES or MSGID_FILE_SET_SHORT_NAME to SbieSvc…
- CVE-2026-97373 MEDIUM · 5.8 draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint…
- CVE-2026-82418 CRITICAL · 9.8 IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability.
- CVE-2026-19319 MEDIUM · 5.3 IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
- CVE-2026-18142 HIGH · 7.1 IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD…
- CVE-2026-17493 HIGH · 7.5 IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
- CVE-2026-16725 MEDIUM · 6.5 IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote authenticated attacker to read arbitrary files from the local filesystem due to path…
- CVE-2026-14252 MEDIUM · 6.2 IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD…