CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-104629 HIGH · 8.8 A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker…
- CVE-2026-101022 MEDIUM · 4.3 A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated…
- CVE-2026-100730 CRITICAL · 9.8 A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to…
- CVE-2026-96396 MEDIUM · 4.9 De Affinity by Canva-applicatie voor macOS vóór 3.3.1 (oktober 2026-release) berekende niet veilig de grootte van een afbeeldingsbuffer bij het genereren van QuickLook-miniaturen en voorbeelden…
- CVE-2026-96395 LOW · 3.6 De Affinity by Canva-app voor macOS vóór 3.3.1 (release van oktober 2026) heeft onvoldoende controles uitgevoerd bij het genereren van QuickLook-miniaturen en previews van Affinity-documentbestanden,…
- CVE-2026-96394 LOW · 2.9 De Affinity by Canva-applicatie voor macOS vóór 3.3.1 (release van oktober 2026) valideerde de afbeeldingsafmetingen niet ten opzichte van de grootte van de pixeldata bij…
- CVE-2026-96393 LOW · 3.6 De Affinity by Canva-app vóór 3.3.1 (release van oktober 2026) voerde onvoldoende controle van de grenzen uit bij het parseren van Affinity-documentbestanden, wat leidde tot…
- CVE-2026-94062 HIGH · 8.1 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue…
- CVE-2026-94061 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whistle-sports-club allows Reflected XSS.This issue affects Whistle -…
- CVE-2026-94060 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Voldor voldor allows Reflected XSS.This issue affects Voldor: from n/a through 1.0.0.
- CVE-2026-94059 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows Reflected XSS.This issue affects Ogency: from n/a through 1.0.0.
- CVE-2026-94058 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue affects Treck: from n/a through 1.0.0.
- CVE-2026-8374 NONE Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated…
- CVE-2026-86405 CRITICAL · 9.8 Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This…
- CVE-2026-85531 CRITICAL · 9.8 Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This…
- CVE-2026-62029 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through…
- CVE-2026-62028 MEDIUM · 5.4 Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects…
- CVE-2026-106602 MEDIUM · 4.8 Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.
- CVE-2026-106601 MEDIUM · 5.4 Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.
- CVE-2026-105883 HIGH · 7.1 Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through…
- CVE-2026-105877 NONE Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through…
- CVE-2026-105872 HIGH · 7.2 Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.
- CVE-2026-105870 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects…
- CVE-2026-105318 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter:…
- CVE-2026-104392 HIGH · 8.8 Deserialisatie van niet-vertrouwde gegevenskwetsbaarheid in ExpressTech Quiz And Survey Master quiz-master-next maakt objectinjectie mogelijk. Dit probleem heeft invloed op Quiz And Survey Master: van n.v.t.…
- CVE-2026-104079 MEDIUM · 4.3 Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish…
- CVE-2026-103413 HIGH · 8.8 Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to…
- CVE-2026-103412 HIGH · 8.8 Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. A project file name supplied through the project file…
- CVE-2026-103220 MEDIUM · 4.5 The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files,…
- CVE-2026-101130 LOW · 3.6 The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files,…
- CVE-2026-101094 LOW · 3.6 The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files,…
- CVE-2026-89235 MEDIUM · 6.8 The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers…
- CVE-2026-87846 MEDIUM · 5.3 The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available…
- CVE-2026-86851 MEDIUM · 6.5 The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation…
- CVE-2026-85348 MEDIUM · 4.3 The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that…
- CVE-2026-62042 MEDIUM · 5.3 Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a…
- CVE-2026-62041 MEDIUM · 5.4 Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Manager: from n/a…
- CVE-2026-62040 MEDIUM · 5.3 Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects…
- CVE-2026-62039 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player:…
- CVE-2026-62036 MEDIUM · 4.3 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensitive Data.This issue affects All…
- CVE-2026-39779 MEDIUM · 4.3 Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asgaros Forum: from n/a through 3.4.0.
- CVE-2026-107419 MEDIUM · 5.4 Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Translation for Polylang:…
- CVE-2026-103329 MEDIUM · 5.3 The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate…
- CVE-2026-97791 NONE In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result…
- CVE-2026-97468 NONE Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/hashCode()), and treated a…
- CVE-2026-86463 NONE Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many…
- CVE-2026-79650 NONE Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and…
- CVE-2026-78384 NONE CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption…
- CVE-2026-73179 NONE Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid…
- CVE-2026-71575 NONE The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to…