CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-18541 MEDIUM · 6.4 IBM Planning Analytics 2.0 en 2.1 is kwetsbaar voor opgeslagen cross-site scripting. Met dit beveiligingslek kan een geverifieerde gebruiker willekeurige JavaScript-code insluiten in de webinterface,…
- CVE-2026-17475 HIGH · 7.1 IBM Planning Analytics 2.0 en 2.1 kunnen een op afstand geverifieerde aanvaller in staat stellen om mappen en applicaties van andere gebruikers te verwijderen vanwege…
- CVE-2026-109675 MEDIUM · 4.3 Frappe Suite voor commit 2697564a9c46da6acc614743eaf9915fe5238f4f bevat een kwetsbaarheid voor gebroken toegangscontrole in de get_mailboxen en get_quota API's waarmee geverifieerde e-mailgebruikers toegang hebben tot de gegevens…
- CVE-2026-109674 MEDIUM · 6.5 Frappe ERPNext voor 15.98.0 en 16.x voor 16.6.0 bevat een kwetsbaarheid voor SQL-injectie in sommige eindpunten veroorzaakt door ontbrekende invoervalidatie. Geverifieerde aanvallers op afstand kunnen…
- CVE-2026-109673 HIGH · 7.3 Frappe ERPNext vóór 15.103.0 en 16.x vóór 16.12.0 bevat een opgeslagen kwetsbaarheid voor cross-site scripting omdat de namen van bepaalde records niet goed worden geneutraliseerd…
- CVE-2026-109672 MEDIUM · 6.5 Frappe ERPNext vóór 15.118.0 en 16.x vóór 16.27.0 bevat een ontbrekende autorisatiekwetsbaarheid in bepaalde eindpunten die er niet in slagen om de juiste autorisatiecontroles af…
- CVE-2026-109671 HIGH · 7.3 Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal…
- CVE-2026-109670 MEDIUM · 5.4 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write…
- CVE-2026-109669 MEDIUM · 4.3 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record…
- CVE-2026-109668 MEDIUM · 4.3 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify…
- CVE-2026-109667 HIGH · 8.8 Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request…
- CVE-2026-109666 MEDIUM · 6.5 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory…
- CVE-2026-109665 MEDIUM · 4.3 Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged…
- CVE-2026-109664 MEDIUM · 4.3 Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due…
- CVE-2026-109663 MEDIUM · 6.5 Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can…
- CVE-2026-109662 MEDIUM · 6.1 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores…
- CVE-2026-109661 MEDIUM · 6.5 Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial…
- CVE-2026-109660 MEDIUM · 6.5 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An…
- CVE-2026-109659 MEDIUM · 6.5 Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users…
- CVE-2026-109658 MEDIUM · 6.5 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users…
- CVE-2026-109657 MEDIUM · 5.4 Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered…
- CVE-2026-109656 MEDIUM · 6.5 Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item…
- CVE-2026-109655 MEDIUM · 6.5 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated…
- CVE-2026-109654 MEDIUM · 5.4 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read…
- CVE-2026-109653 HIGH · 7.3 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without…
- CVE-2026-109652 HIGH · 8.8 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing…
- CVE-2026-109651 MEDIUM · 4.3 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that…
- CVE-2026-109650 MEDIUM · 6.5 Frappe ERPNext vóór 15.112.0 en 16.x vóór 16.23.0 bevat een ontbrekende autorisatiekwetsbaarheid in bepaalde eindpunten die er niet in slagen om de juiste autorisatiecontroles af…
- CVE-2026-109649 MEDIUM · 6.5 Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database…
- CVE-2026-109648 MEDIUM · 6.5 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send…
- CVE-2026-109647 MEDIUM · 6.5 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send…
- CVE-2026-109646 MEDIUM · 6.5 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can…
- CVE-2026-109645 MEDIUM · 6.5 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers…
- CVE-2026-109644 MEDIUM · 6.5 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation…
- CVE-2026-109643 MEDIUM · 6.5 Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged…
- CVE-2026-109642 MEDIUM · 4.3 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users…
- CVE-2026-109641 MEDIUM · 6.5 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers…
- CVE-2026-109640 HIGH · 8.1 Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can…
- CVE-2026-109639 MEDIUM · 6.5 Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database…
- CVE-2026-109638 MEDIUM · 6.5 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send…
- CVE-2026-109637 MEDIUM · 6.5 Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests…
- CVE-2026-109636 MEDIUM · 6.5 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with…
- CVE-2026-109635 MEDIUM · 4.3 Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting…
- CVE-2026-109634 MEDIUM · 4.9 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers with high…
- CVE-2026-109633 HIGH · 8.1 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without…
- CVE-2026-109632 MEDIUM · 6.5 Frappe ERPNext voor 15.121.0 en 16.x voor 16.33.0 bevat een ontbrekende autorisatiekwetsbaarheid waarbij bepaalde eindpunten er niet in slagen om de juiste autorisatiecontroles af te…
- CVE-2026-109631 MEDIUM · 6.5 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter…
- CVE-2026-109630 MEDIUM · 4.3 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers…
- CVE-2026-109629 MEDIUM · 4.3 Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing…
- CVE-2026-109628 MEDIUM · 6.5 Frappe ERPNext vóór versie 15.121.0 en 16.x vóór versie 16.34.0 bevat een beveiligingslek met betrekking tot ontbrekende autorisatie in bepaalde eindpunten. Deze eindpunten voeren geen…