CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-107835 MEDIUM · 4.0 OWASP Coraza WAF is een met golang modsecurity compatibele firewallbibliotheek voor webtoepassingen. Voorafgaand aan 3.8.1, interne/cookies.ParseCookies in interne/cookies/cookies.go behandelt grens ASCII-controletekens en control-only of lege…
- CVE-2026-107834 MEDIUM · 5.3 OWASP Coraza WAF is een met golang modsecurity compatibele firewallbibliotheek voor webtoepassingen. Van 3.0.0 tot 3.8.0 voert de meerdelige lus in interne/bodyprocessors/multipart.go uitstel temp.Close ()…
- CVE-2026-107833 MEDIUM · 5.9 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1…
- CVE-2026-107826 HIGH · 7.5 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk…
- CVE-2026-107825 MEDIUM · 4.0 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining…
- CVE-2026-107824 NONE x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server…
- CVE-2026-107823 HIGH · 7.2 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser… Mariadb
- CVE-2026-107822 MEDIUM · 6.4 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate… Mariadb
- CVE-2026-107821 HIGH · 8.0 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets,… Mariadb
- CVE-2026-107820 MEDIUM · 5.3 x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcp_server.zig parses…
- CVE-2026-107819 MEDIUM · 5.9 MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb…
- CVE-2026-107818 HIGH · 8.4 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster… Mariadb
- CVE-2026-107817 MEDIUM · 4.4 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that… Mariadb
- CVE-2026-107816 MEDIUM · 6.4 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be… Mariadb
- CVE-2026-75597 MEDIUM · 5.3 pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication…
- CVE-2026-75347 HIGH · 7.5 EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) handling logic. This…
- CVE-2026-55797 HIGH · 8.8 Argo CD is een declaratieve, GitOps continue bezorgtool voor Kubernetes. Van 2.11.0 tot 3.3.15, 3.4.10, 3.5.4 en 3.6.0-rc2 is de Argo CD repo-server kwetsbaar voor…
- CVE-2026-48484 MEDIUM · 6.5 pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading…
- CVE-2026-42695 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer…
- CVE-2026-108160 HIGH · 7.5 AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's…
- CVE-2026-108159 HIGH · 7.5 AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized…
- CVE-2026-108158 MEDIUM · 6.5 plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted…
- CVE-2026-108157 HIGH · 8.1 Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth…
- CVE-2026-108156 HIGH · 7.1 LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's…
- CVE-2026-108119 MEDIUM · 6.3 A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the…
- CVE-2026-108093 MEDIUM · 5.5 A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening…
- CVE-2026-107815 HIGH · 8.5 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table… Mariadb
- CVE-2025-61560 NONE A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a…
- CVE-2016-20098 MEDIUM · 5.4 Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit toolbox wiki fields into popup HTML without…
- CVE-2026-90983 HIGH · 8.2 Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass. This issue affects Hayat Mobile: from 3.3.0 before…
- CVE-2026-75349 HIGH · 7.5 EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker to cause a…
- CVE-2026-75348 HIGH · 7.5 An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The…
- CVE-2026-75346 HIGH · 7.5 An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This allows a remote attacker…
- CVE-2026-75345 HIGH · 7.5 OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of…
- CVE-2026-108113 HIGH · 8.8 ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write…
- CVE-2026-108112 MEDIUM · 5.4 ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow…
- CVE-2026-108111 MEDIUM · 4.3 ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query…
- CVE-2026-108110 MEDIUM · 6.8 MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying…
- CVE-2026-107814 HIGH · 8.4 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the… Mariadb
- CVE-2026-107813 HIGH · 8.8 Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations…
- CVE-2026-107812 HIGH · 7.5 Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with…
- CVE-2026-107811 HIGH · 8.8 Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose…
- CVE-2026-107810 HIGH · 8.1 Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and…
- CVE-2026-107809 HIGH · 8.8 Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API…
- CVE-2026-107808 HIGH · 8.1 Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a…
- CVE-2026-107807 HIGH · 8.8 Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the…
- CVE-2026-107783 MEDIUM · 5.9 Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS…
- CVE-2026-104084 HIGH · 8.8 SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated…
- CVE-2026-104083 MEDIUM · 6.1 SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a element…
- CVE-2026-104082 HIGH · 7.2 SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory…