CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-103080 MEDIUM · 5.3 External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0.
- CVE-2026-94451 MEDIUM · 6.5 Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly…
- CVE-2026-85976 MEDIUM · 5.4 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-exploration endpoint, which…
- CVE-2026-85975 HIGH · 7.5 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker…
- CVE-2026-85974 HIGH · 7.4 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned…
- CVE-2026-85973 HIGH · 7.4 Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned attacker could intercept or modify information transmitted through…
- CVE-2026-85972 HIGH · 7.4 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain…
- CVE-2026-85971 HIGH · 7.1 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a…
- CVE-2026-85970 HIGH · 7.1 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could…
- CVE-2026-85969 HIGH · 7.1 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker…
- CVE-2026-85968 HIGH · 7.1 Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to…
- CVE-2026-85967 MEDIUM · 6.1 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that could allow a remote attacker to execute…
- CVE-2026-85966 HIGH · 7.7 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker…
- CVE-2026-85965 HIGH · 8.0 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory…
- CVE-2026-85964 HIGH · 7.7 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a…
- CVE-2026-85963 HIGH · 7.5 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker…
- CVE-2026-85962 HIGH · 7.5 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML…
- CVE-2026-85961 HIGH · 7.5 On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic logs under certain…
- CVE-2026-85960 HIGH · 7.5 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an…
- CVE-2026-85959 HIGH · 7.5 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit…
- CVE-2026-85958 HIGH · 7.5 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a…
- CVE-2026-85957 HIGH · 7.5 Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended…
- CVE-2026-84286 NONE ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model…
- CVE-2026-75888 HIGH · 7.7 A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted…
- CVE-2026-109374 MEDIUM · 5.5 ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAM_OWNER by bypassing the…
- CVE-2026-109373 HIGH · 8.1 ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by…
- CVE-2026-109372 HIGH · 8.7 ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the…
- CVE-2026-109371 HIGH · 8.2 ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to…
- CVE-2026-109366 LOW · 3.7 Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks…
- CVE-2026-109365 LOW · 3.7 Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid…
- CVE-2026-109364 MEDIUM · 5.3 Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact…
- CVE-2026-109363 HIGH · 7.5 ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of…
- CVE-2026-109362 MEDIUM · 5.4 Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after…
- CVE-2026-109361 HIGH · 7.3 MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results…
- CVE-2026-109360 HIGH · 7.5 MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over…
- CVE-2026-109359 HIGH · 7.7 Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation.…
- CVE-2026-109358 HIGH · 7.8 Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on…
- CVE-2026-109357 HIGH · 8.1 LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only…
- CVE-2026-109356 MEDIUM · 4.3 LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts…
- CVE-2026-109355 MEDIUM · 6.1 LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response…
- CVE-2026-109354 MEDIUM · 4.3 LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the…
- CVE-2026-109353 HIGH · 7.1 LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can…
- CVE-2026-109352 MEDIUM · 6.1 LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, populated from SNMP DisplayString fields during discovery, into…
- CVE-2026-109351 MEDIUM · 6.5 Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count.…
- CVE-2026-109350 MEDIUM · 6.5 Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers…
- CVE-2026-109349 MEDIUM · 6.5 gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A…
- CVE-2026-109348 MEDIUM · 4.3 Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attackers can commit a…
- CVE-2026-109347 HIGH · 7.2 Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with…
- CVE-2026-109346 HIGH · 8.1 better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can…
- CVE-2026-109345 MEDIUM · 6.1 DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content…