CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-109244 MEDIUM · 6.6 FreeRDP-versies 2.0.0 en 3.32.0 bevatten een beveiligingslek in winpr-makecert waardoor niet-versleutelde privésleutels worden aangemaakt zonder dat de bestandsmodus alleen de eigenaar toelaat. Lokale gebruikers op…
- CVE-2026-109243 MEDIUM · 4.4 FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner-only permissions.…
- CVE-2026-109242 HIGH · 7.1 FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious… Freerdp
- CVE-2026-109241 LOW · 3.1 FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order… Freerdp
- CVE-2026-109240 LOW · 3.1 FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers… Freerdp
- CVE-2026-109239 MEDIUM · 5.3 Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass Docker server egress controls. Attackers can enable check_robots_txt…
- CVE-2026-109238 HIGH · 8.6 Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl requests. Attackers…
- CVE-2026-109237 HIGH · 8.1 Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type…
- CVE-2026-108914 CRITICAL · 9.9 A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the…
- CVE-2026-108909 MEDIUM · 4.3 A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing a…
- CVE-2026-108908 LOW · 2.4 A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7_call_board_user_set.cgi of the component Web UI.…
- CVE-2026-108907 CRITICAL · 10.0 A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack…
- CVE-2026-108478 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack…
- CVE-2026-108477 MEDIUM · 5.3 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
- CVE-2026-108476 MEDIUM · 5.0 Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from…
- CVE-2026-108475 MEDIUM · 4.3 Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through…
- CVE-2026-105274 NONE Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to…
- CVE-2026-9191 CRITICAL · 9.6 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation…
- CVE-2026-96618 NONE Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of…
- CVE-2026-96612 NONE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside…
- CVE-2026-92682 NONE In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when…
- CVE-2026-92681 NONE In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored…
- CVE-2026-85956 CRITICAL · 9.6 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore…
- CVE-2026-85955 CRITICAL · 9.9 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function…
- CVE-2026-85954 HIGH · 8.6 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated…
- CVE-2026-85953 HIGH · 8.5 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths…
- CVE-2026-85952 HIGH · 8.5 Beïnvloede Linux-gebaseerde Progress MarkLogic Server 12.x-releases vóór 12.1.0 en 11.x-releases vóór 11.3.7 bevatten een kwetsbaarheid voor het vervalsen van verzoeken aan de serverzijde waardoor een…
- CVE-2026-85951 HIGH · 8.5 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated…
- CVE-2026-85950 HIGH · 8.4 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges…
- CVE-2026-85949 HIGH · 8.1 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with…
- CVE-2026-85948 CRITICAL · 9.9 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A…
- CVE-2026-85947 CRITICAL · 9.9 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management…
- CVE-2026-81856 NONE Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal…
- CVE-2026-109399 HIGH · 8.1 SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding…
- CVE-2026-109398 HIGH · 7.5 Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits.…
- CVE-2026-109397 HIGH · 7.2 Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a…
- CVE-2026-109396 MEDIUM · 4.2 Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration,…
- CVE-2026-109394 HIGH · 7.4 Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers…
- CVE-2026-109393 MEDIUM · 6.3 QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htl_access hotel checks.…
- CVE-2026-109392 MEDIUM · 5.4 Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers…
- CVE-2026-109391 HIGH · 8.1 Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences…
- CVE-2026-109195 LOW · 3.1 A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs…
- CVE-2026-109194 MEDIUM · 6.4 A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger belongs to…
- CVE-2026-108906 HIGH · 7.2 Er is een kwetsbaarheid ontdekt in Netcore NR268 1.7.121109. Deze kwetsbaarheid betreft de functie filter_arp_put_file_cgi van het bestand /router/filter_arp_put_file.cgi. Manipulatie van het argument put_file leidt…
- CVE-2026-108901 LOW · 3.5 A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR…
- CVE-2026-108900 HIGH · 7.3 Er is een kwetsbaarheid gevonden in Exponent CMS tot 3.0.2patch2. Getroffen is de functie userLogin van het bestand xmlrpc.php van de component XML-RPC. Dergelijke manipulatie…
- CVE-2026-108899 HIGH · 7.3 A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception…
- CVE-2026-107248 NONE De backoffice-e-mail/berichten-functie van Thelia 3.0.0 bevat een server-side template injection (SstI) -fout waarmee elke geverifieerde gebruiker met de "Berichten" -machtiging unsandboxed Twig-sjablonen kan leveren, die…
- CVE-2026-105668 NONE Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get…
- CVE-2026-105280 NONE Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output…