CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-90912 HIGH · 7.5 IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
- CVE-2026-90911 HIGH · 7.5 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
- CVE-2026-84312 HIGH · 7.1 Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant…
- CVE-2026-54459 MEDIUM · 4.3 FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and…
- CVE-2026-53922 MEDIUM · 6.5 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first…
- CVE-2026-49484 NONE Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores…
- CVE-2026-49483 NONE Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing…
- CVE-2026-44828 NONE Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion…
- CVE-2026-41210 MEDIUM · 6.5 Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session…
- CVE-2026-108934 LOW · 2.4 Er is een beveiligingsfout ontdekt in Edimax BR-6208AC 1.32. Beïnvloed door deze kwetsbaarheid is een onbekende functionaliteit van het bestand /goform/formUrlb van de HTTP-blokkeringspagina van…
- CVE-2026-108933 LOW · 2.4 Er is een kwetsbaarheid vastgesteld in Edimax BR-6208AC 1.32. Getroffen is een onbekende functie van het bestand /goform/formFilter. Dergelijke manipulatie leidt tot cross-site scripting. De…
- CVE-2026-108932 MEDIUM · 4.3 In Netcore NR268 1.7.121109 is een kwetsbaarheid vastgesteld. Dit heeft invloed op de functie-eval van het bestandsfilter_hosts_dump.cgi van de component DHCP Hostname Handler. Deze manipulatie…
- CVE-2026-104140 MEDIUM · 6.1 QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC…
- CVE-2026-103658 MEDIUM · 5.9 GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes…
- CVE-2026-102596 MEDIUM · 4.3 Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with…
- CVE-2026-102539 NONE Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls…
- CVE-2026-97691 MEDIUM · 4.3 Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled-2026-08-10-c0cb7ae, a…
- CVE-2026-96266 HIGH · 8.2 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the…
- CVE-2026-96265 HIGH · 8.2 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to…
- CVE-2026-96264 HIGH · 8.2 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to…
- CVE-2026-96263 HIGH · 8.2 IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process…
- CVE-2026-96262 HIGH · 8.2 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the…
- CVE-2026-96261 HIGH · 7.3 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the…
- CVE-2026-92120 NONE OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the…
- CVE-2026-92119 NONE REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the…
- CVE-2026-92116 NONE OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.
- CVE-2026-84360 HIGH · 8.1 Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and…
- CVE-2026-84321 MEDIUM · 5.4 Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value,…
- CVE-2026-84320 MEDIUM · 6.3 Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns…
- CVE-2026-84319 HIGH · 8.3 Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such…
- CVE-2026-84318 HIGH · 8.8 Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to…
- CVE-2026-84317 HIGH · 8.8 Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx…
- CVE-2026-84316 HIGH · 8.8 Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first…
- CVE-2026-84315 HIGH · 8.3 Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation…
- CVE-2026-84314 NONE Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to…
- CVE-2026-84313 HIGH · 8.8 Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and…
- CVE-2026-78673 HIGH · 7.5 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.
- CVE-2026-75881 HIGH · 7.5 IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an…
- CVE-2026-58462 NONE Reden van afwijzing: deze CVE-ID is afgewezen of ingetrokken door de CVE-nummeringsinstantie.
- CVE-2026-53997 HIGH · 7.4 Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing…
- CVE-2026-41508 MEDIUM · 5.8 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal…
- CVE-2026-41504 MEDIUM · 5.8 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request…
- CVE-2026-18537 HIGH · 8.7 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container…
- CVE-2026-18533 MEDIUM · 6.5 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container…
- CVE-2026-18529 HIGH · 8.7 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a…
- CVE-2026-18517 HIGH · 7.7 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is…
- CVE-2026-18513 HIGH · 7.2 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom…
- CVE-2026-16678 MEDIUM · 4.5 IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81 could allow a remote authenticated attacker to cause a denial of…
- CVE-2026-109571 MEDIUM · 4.3 Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic (0x2A37).…
- CVE-2026-109570 MEDIUM · 4.3 Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command…