CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-109569 HIGH · 8.8 sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root. Agent-run…
- CVE-2026-109568 HIGH · 7.1 Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users…
- CVE-2026-109567 HIGH · 7.2 Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission…
- CVE-2026-109566 CRITICAL · 9.8 Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account…
- CVE-2026-109565 MEDIUM · 6.1 Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can…
- CVE-2026-109564 LOW · 3.1 LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get_playground. Authenticated users with playground…
- CVE-2026-109563 HIGH · 7.5 N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can…
- CVE-2026-109562 MEDIUM · 5.4 SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks.…
- CVE-2026-109561 MEDIUM · 4.2 goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only…
- CVE-2026-109560 HIGH · 7.5 Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules.…
- CVE-2026-109559 HIGH · 8.7 EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers…
- CVE-2026-109558 HIGH · 8.7 EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can…
- CVE-2026-109557 HIGH · 8.7 EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can…
- CVE-2026-109556 HIGH · 8.0 EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied…
- CVE-2026-109427 MEDIUM · 6.5 Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs…
- CVE-2026-109426 HIGH · 7.5 Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated…
- CVE-2026-109380 HIGH · 7.5 modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can…
- CVE-2026-109379 MEDIUM · 5.3 Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers…
- CVE-2026-109378 MEDIUM · 4.3 SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with valider_url_distante(). Authenticated…
- CVE-2026-109377 MEDIUM · 4.3 ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal…
- CVE-2026-109376 MEDIUM · 4.3 ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Timesheets. The method only checks…
- CVE-2026-109375 MEDIUM · 6.1 Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by planting…
- CVE-2026-108931 MEDIUM · 4.3 Er is een kwetsbaarheid gevonden in Netcore NR268 1.7.121109. Dit heeft invloed op de functie-eval van het bestand dhcp_dynamicip_show.cgi van de component DHCP Handler. De…
- CVE-2026-108930 LOW · 2.7 Er is een kwetsbaarheid gevonden in Netcore NR268 1.7.121109. Het getroffen element is de functie ddns_wan_list_show van het bestand ddns_wan_list_show.cgi van de component DDNS Handler.…
- CVE-2026-108929 CRITICAL · 9.9 Er is een fout gevonden in Netcore NR268 1.7.121109. Het getroffen element is de functie execvp van het bestand /router/DDNSset.cgi van de component DDNS. Het…
- CVE-2026-108928 MEDIUM · 6.3 Er is een beveiligingslek gedetecteerd in itsourcecode Online Admission System 1.0. Dit probleem heeft invloed op een onbekende verwerking van het bestand /admin/sum.php. Een dergelijke…
- CVE-2026-108927 MEDIUM · 6.3 Er is een zwakte vastgesteld in zijn broncode Baptism Information Management System 1.0. Dit beveiligingslek heeft invloed op de onbekende code van het bestand pbaptism.php.…
- CVE-2026-106495 MEDIUM · 4.3 Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation.…
- CVE-2026-105052 HIGH · 7.5 IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send…
- CVE-2025-71429 CRITICAL · 9.8 GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter…
- CVE-2024-58389 MEDIUM · 6.1 HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next…
- CVE-2022-51020 MEDIUM · 5.9 Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated…
- CVE-2021-48012 HIGH · 8.2 fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers…
- CVE-2021-48011 HIGH · 7.5 Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers…
- CVE-2020-37280 HIGH · 7.5 cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply…
- CVE-2020-37279 HIGH · 8.1 easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path,…
- CVE-2026-96012 CRITICAL · 9.9 IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization…
- CVE-2026-95838 NONE containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations.…
- CVE-2026-95837 HIGH · 7.8 containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state…
- CVE-2026-41510 HIGH · 7.2 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while…
- CVE-2026-109575 CRITICAL · 9.8 In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple…
- CVE-2026-109425 MEDIUM · 5.3 Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or…
- CVE-2026-109424 MEDIUM · 5.9 NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted…
- CVE-2026-109423 HIGH · 7.4 NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and…
- CVE-2026-109422 HIGH · 8.1 NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes…
- CVE-2026-108926 MEDIUM · 6.3 Er is een beveiligingsfout ontdekt in itsourcecode Baptism Information Management System 1.0. Dit heeft invloed op een onbekend deel van het bestand ebaptism.php. De manipulatie…
- CVE-2026-108924 MEDIUM · 4.3 Er werd een kwetsbaarheid geïdentificeerd in getkirby Kirby tot aan 4.9.5/5.5.3. Beïnvloed door dit probleem is de functie OptionsQuery::resolve van het bestand src/Option/OptionsQuery.php van de…
- CVE-2026-108923 MEDIUM · 6.3 A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component…
- CVE-2026-108362 NONE Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted…
- CVE-2026-108361 NONE Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data,…