CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-107736 NONE SumatraPDF is een multi-format reader voor Windows. In 3.6.1 en eerder vraagt MaybeFlipBitmap () GDI+ om de door de aanvaller gecontroleerde PropertyTagOrientation-grootte te lezen via…
- CVE-2026-107735 NONE SumatraPDF is een multi-format reader voor Windows. In 3.6.1 en eerder startInitializePolicies () het sumatrapdfrestrict.ini-pad met gPolicyRestrictions ingesteld op Perm::All and only ORS-machtigingsbits, zodat het…
- CVE-2026-107734 NONE SumatraPDF is een multi-format reader voor Windows. In 3.5.2 en eerder wordt een door een aanvaller gecontroleerde SyncTeX-bronbestandsnaam vervangen door de %f tijdelijke aanduiding in…
- CVE-2026-107733 NONE SumatraPDF is een multi-format reader voor Windows. In 3.6.1 en eerder behandelt FrameOnCommand() CmdExec door een null current-tab-aanwijzer door te geven aan RunWithExe(), die WindowTab::…
- CVE-2026-107732 NONE SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip()…
- CVE-2026-107731 MEDIUM · 5.5 SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to…
- CVE-2026-107730 MEDIUM · 5.5 SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces * 16 section offset using signed 32-bit…
- CVE-2026-107729 MEDIUM · 5.5 SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INT_MAX…
- CVE-2026-107728 HIGH · 7.5 Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for…
- CVE-2026-107727 LOW · 3.7 Strawberry GraphQL is een bibliotheek voor het maken van GraphQL API's. Van 0.312.3 tot 0.327.2 verwijdert de verouderde graphql-ws abonnementshandler in aardbeien/abonnementen/protocollen/graphql_ws/handlers.py geen natuurlijk voltooide…
- CVE-2026-107651 MEDIUM · 5.5 A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when…
- CVE-2026-105674 NONE TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable…
- CVE-2026-105673 NONE An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled.…
- CVE-2026-105672 NONE TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent…
- CVE-2026-100197 NONE Reden van afwijzing: deze CVE-ID is afgewezen of ingetrokken door de CVE-nummeringsinstantie.
- CVE-2026-89091 HIGH · 8.8 A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath)…
- CVE-2026-87980 LOW · 3.1 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive information in…
- CVE-2026-84891 MEDIUM · 5.9 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of hard-coded credentials.
- CVE-2026-84875 HIGH · 7.5 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
- CVE-2026-84249 CRITICAL · 9.8 IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.
- CVE-2026-84247 HIGH · 8.1 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability. Ibm
- CVE-2026-84246 HIGH · 8.1 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. Ibm
- CVE-2026-84230 HIGH · 7.5 IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized… Ibm
- CVE-2026-84209 HIGH · 8.1 IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used… Ibm
- CVE-2026-84198 HIGH · 8.1 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. Ibm
- CVE-2026-84058 HIGH · 8.1 IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker… Ibm
- CVE-2026-84057 HIGH · 8.1 IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in… Ibm
- CVE-2026-84035 HIGH · 8.1 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. Ibm
- CVE-2026-84032 MEDIUM · 5.6 IBM Guardium Data Protection 12.2.2 could allow a remote attacker to conduct a man-in-the-middle attack due to improper certificate validation. Ibm
- CVE-2026-82900 HIGH · 8.1 IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a… Ibm
- CVE-2026-82895 HIGH · 8.1 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. Ibm
- CVE-2026-81932 HIGH · 8.6 IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow… Ibm
- CVE-2026-80381 CRITICAL · 9.8 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection. Ibm
- CVE-2026-75875 CRITICAL · 9.8 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal. Ibm
- CVE-2026-107831 MEDIUM · 4.3 Jivejdon tot en met 5.0 bevat een kwetsbaarheid voor het vervalsen van cross-site verzoeken waarmee externe aanvallers statusveranderende acties kunnen uitvoeren door GET-eindpunten TE misbruiken…
- CVE-2026-107830 MEDIUM · 5.3 Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load…
- CVE-2026-107829 MEDIUM · 5.9 Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql. Attackers who obtain the…
- CVE-2026-107828 MEDIUM · 6.5 Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials from public Weibo user IDs.…
- CVE-2026-107801 MEDIUM · 5.4 Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can…
- CVE-2026-107800 MEDIUM · 5.4 Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message…
- CVE-2026-107799 MEDIUM · 5.4 Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are…
- CVE-2026-107798 MEDIUM · 5.4 jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href…
- CVE-2026-107797 MEDIUM · 6.1 Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can…
- CVE-2026-107796 MEDIUM · 6.1 Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that allows unauthenticated attackers to inject script via unencoded tagID…
- CVE-2026-107793 MEDIUM · 4.3 Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a…
- CVE-2026-107792 MEDIUM · 4.3 Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can…
- CVE-2026-107726 NONE Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data…
- CVE-2026-107725 NONE Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in…
- CVE-2026-107724 HIGH · 7.4 fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because…
- CVE-2026-107723 HIGH · 8.1 fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because…