CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-108623 HIGH · 7.1 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged…
- CVE-2026-108622 MEDIUM · 5.4 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers…
- CVE-2026-108621 MEDIUM · 4.3 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can…
- CVE-2026-108620 MEDIUM · 5.4 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can…
- CVE-2026-108619 MEDIUM · 5.4 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply…
- CVE-2026-108618 MEDIUM · 4.3 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids…
- CVE-2026-108617 MEDIUM · 4.3 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal…
- CVE-2026-108616 MEDIUM · 5.4 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI evaluator records. Low-privileged attackers…
- CVE-2026-108615 MEDIUM · 5.4 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can…
- CVE-2026-108614 MEDIUM · 4.3 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers…
- CVE-2026-108613 MEDIUM · 5.4 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI…
- CVE-2026-108612 MEDIUM · 5.4 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated users to delete word templates. Attackers can send…
- CVE-2026-108611 MEDIUM · 5.4 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can…
- CVE-2026-108610 MEDIUM · 4.3 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates. Low-privileged attackers can…
- CVE-2026-108609 MEDIUM · 4.3 JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId…
- CVE-2026-108608 MEDIUM · 4.3 JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary…
- CVE-2026-108607 MEDIUM · 4.3 JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary…
- CVE-2026-108606 MEDIUM · 5.4 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can…
- CVE-2026-108605 MEDIUM · 4.3 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers…
- CVE-2026-97853 NONE Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal…
- CVE-2026-81797 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme
- CVE-2026-78535 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Photolia
- CVE-2026-78534 HIGH · 7.1 Unauthenticated Cross Site Scripting (XSS) in Educavo
- CVE-2026-78533 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Qwery
- CVE-2026-78532 HIGH · 7.1 Niet-geauthenticeerde Cross Site Scripting (XSS) in LMS
- CVE-2026-78531 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Jacqueline
- CVE-2026-78530 HIGH · 7.7 Subscriber Arbitrary File Deletion in FoodBakery
- CVE-2026-78529 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Alliance
- CVE-2026-66569 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Kicker
- CVE-2026-66568 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Original
- CVE-2026-66567 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Anesta
- CVE-2026-66566 HIGH · 8.1 Unauthenticated Local File Inclusion in Ambient
- CVE-2026-66565 CRITICAL · 9.8 Unauthenticated PHP Object Injection in FC United
- CVE-2026-66564 CRITICAL · 9.8 Unauthenticated PHP Object Injection in ShiftCV
- CVE-2026-66563 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Windsor
- CVE-2026-66483 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Education Center
- CVE-2026-66482 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Drone Media
- CVE-2026-66481 MEDIUM · 6.8 Author Arbitrary File Deletion in Presto Player Pro
- CVE-2026-66480 MEDIUM · 5.3 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects…
- CVE-2026-65459 HIGH · 7.5 Unauthenticated Arbitrary Content Deletion in Forminator
- CVE-2026-62130 HIGH · 7.2 Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency
- CVE-2026-62129 CRITICAL · 9.9 Contributor Arbitrary File Upload in Creator LMS
- CVE-2026-62125 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Asia Garden
- CVE-2026-62124 CRITICAL · 9.8 Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events
- CVE-2026-62123 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Invetex
- CVE-2026-62120 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Law Office
- CVE-2026-62118 HIGH · 7.3 Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager
- CVE-2026-62117 HIGH · 8.5 Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager
- CVE-2026-62116 HIGH · 7.1 Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager
- CVE-2026-62115 HIGH · 8.1 Unauthenticated Local File Inclusion in KuteShop