CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-109627 MEDIUM · 6.5 Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged…
- CVE-2026-109626 MEDIUM · 6.5 Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially…
- CVE-2026-109625 MEDIUM · 6.5 Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users…
- CVE-2026-109624 MEDIUM · 6.5 Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged…
- CVE-2026-109623 MEDIUM · 5.4 Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers…
- CVE-2026-109622 MEDIUM · 4.3 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users…
- CVE-2026-109621 MEDIUM · 6.5 Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement.…
- CVE-2026-109617 HIGH · 7.1 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document…
- CVE-2026-109616 HIGH · 7.1 Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users…
- CVE-2026-109615 MEDIUM · 6.5 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document…
- CVE-2026-109614 MEDIUM · 6.5 Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints…
- CVE-2026-109613 HIGH · 7.1 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document…
- CVE-2026-109612 HIGH · 7.3 Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup…
- CVE-2026-109611 MEDIUM · 4.3 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users…
- CVE-2026-109610 MEDIUM · 6.5 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users…
- CVE-2026-109609 MEDIUM · 6.5 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges…
- CVE-2026-109608 HIGH · 8.8 Frappe ERPNext vóór 15.121.0 en 16.x vóór 16.34.0 bevat een kwetsbaarheid voor SQL-injectie in verschillende eindpunten die geen invoervalidatie hebben. Elke geverifieerde gebruiker, inclusief een…
- CVE-2026-109604 HIGH · 7.3 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without…
- CVE-2026-109603 LOW · 3.3 Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forgery and local…
- CVE-2026-109602 MEDIUM · 5.4 Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich…
- CVE-2026-109601 MEDIUM · 6.5 Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who…
- CVE-2026-109600 MEDIUM · 5.3 Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled…
- CVE-2026-109599 MEDIUM · 4.3 Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can…
- CVE-2026-109598 MEDIUM · 4.3 Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the…
- CVE-2026-109597 MEDIUM · 5.4 Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs.…
- CVE-2026-109596 MEDIUM · 5.5 Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor…
- CVE-2026-109595 MEDIUM · 5.5 Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's…
- CVE-2026-109574 MEDIUM · 5.5 Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the…
- CVE-2026-109573 HIGH · 8.1 phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs…
- CVE-2026-109572 HIGH · 7.6 Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API…
- CVE-2026-108938 MEDIUM · 5.3 Er is een fout gevonden in code-projecten Huwelijkssysteem 1.0. Dit probleem heeft invloed op een onbekende verwerking van het bestand db/matrimony.sql. Deze manipulatie zorgt ervoor…
- CVE-2026-108937 MEDIUM · 5.3 Er is een kwetsbaarheid gedetecteerd in code-projects Online Ticket Reservation System 1.0. Deze kwetsbaarheid heeft invloed op de onbekende code van het bestand /database/medallion.sql. De…
- CVE-2026-108936 LOW · 2.4 Er is een beveiligingslek gedetecteerd in Edimax BR-6208AC 1.32. Dit heeft invloed op een onbekend deel van het bestand /goform/formQoS van de component QoS-pagina. De…
- CVE-2026-108935 LOW · 2.4 Er is een zwakte vastgesteld in Edimax BR-6208AC 1.32. Beïnvloed door dit probleem is een onbekende functionaliteit van het bestand /goform/formPortFw van de component Port…
- CVE-2026-102627 HIGH · 8.8 IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during…
- CVE-2025-71432 HIGH · 8.1 Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary…
- CVE-2025-71431 MEDIUM · 5.3 Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP…
- CVE-2025-71430 MEDIUM · 5.4 Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization.…
- CVE-2024-58391 MEDIUM · 4.3 Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers…
- CVE-2024-58390 HIGH · 8.8 Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User…
- CVE-2023-54412 MEDIUM · 6.5 Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create…
- CVE-2023-54411 MEDIUM · 5.9 Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted…
- CVE-2023-54410 MEDIUM · 4.3 Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check. Attackers can invoke the…
- CVE-2023-54409 MEDIUM · 4.8 Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted…
- CVE-2023-54408 MEDIUM · 6.1 Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit…
- CVE-2023-54407 MEDIUM · 4.9 Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in…
- CVE-2023-54406 MEDIUM · 4.9 Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution when one…
- CVE-2026-92876 HIGH · 7.5 IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled…
- CVE-2026-90921 HIGH · 7.5 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames,…
- CVE-2026-90920 CRITICAL · 9.8 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.