CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-107722 CRITICAL · 9.8 fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key…
- CVE-2026-107721 MEDIUM · 5.9 fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type and negativity…
- CVE-2026-107720 HIGH · 7.4 fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null…
- CVE-2026-107719 MEDIUM · 4.2 fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its…
- CVE-2026-107718 MEDIUM · 6.1 AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter…
- CVE-2026-107717 MEDIUM · 6.5 Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as…
- CVE-2026-107716 NONE Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and…
- CVE-2026-107715 MEDIUM · 6.8 The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP…
- CVE-2026-107714 MEDIUM · 5.9 The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing…
- CVE-2026-107406 NONE Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as…
- CVE-2026-107399 MEDIUM · 6.8 The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled.…
- CVE-2026-105275 MEDIUM · 4.3 Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import functionality. An authenticated user with Viewer privileges could…
- CVE-2026-105269 MEDIUM · 6.8 Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user with Network Operator privileges could store untrusted content…
- CVE-2026-104628 MEDIUM · 6.5 Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An authenticated user with Viewer privileges could submit crafted search input…
- CVE-2025-71428 MEDIUM · 4.9 Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin…
- CVE-2026-95116 HIGH · 7.5 An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c.
- CVE-2026-79842 CRITICAL · 9.1 An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713
- CVE-2026-78407 MEDIUM · 5.4 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user… Ibm
- CVE-2026-78406 CRITICAL · 9.8 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code… Ibm
- CVE-2026-78401 CRITICAL · 9.8 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code… Ibm
- CVE-2026-78399 MEDIUM · 6.5 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of service… Ibm
- CVE-2026-78388 MEDIUM · 4.3 IBM Security Verify Access 10.0 t/m 10.0.9.2 en IBM Verify Identity Access 11.0 t/m 11.0.3 is kwetsbaar voor cross-site request vervalsing waardoor een aanvaller kwaadaardige… Ibm
- CVE-2026-62181 NONE Reden van afwijzing: Deze CVE is een duplicaat van een andere CVE.
- CVE-2026-19878 MEDIUM · 6.5 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass additional authentication… Ibm
- CVE-2026-19498 MEDIUM · 5.9 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to cause a denial of… Ibm
- CVE-2026-19494 HIGH · 8.1 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions… Ibm
- CVE-2026-19493 HIGH · 7.5 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to perform an arbitrary file… Ibm
- CVE-2026-19491 CRITICAL · 9.1 IBM Security Verify Access 10.0 t/m 10.0.9.2 en IBM Verify Identity Access 11.0 t/m 11.0.3 kunnen een externe aanvaller toestaan om authenticatie te omzeilen vanwege… Ibm
- CVE-2026-19482 HIGH · 8.8 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary commands due… Ibm
- CVE-2026-18740 HIGH · 8.8 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to perform unauthorized actions… Ibm
- CVE-2026-17189 HIGH · 8.2 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated… Ibm
- CVE-2026-16916 CRITICAL · 9.1 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code… Ibm
- CVE-2026-16830 MEDIUM · 5.4 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and… Ibm
- CVE-2026-16823 CRITICAL · 9.1 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due… Ibm
- CVE-2026-12109 MEDIUM · 5.5 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an attacker with administrative privileges and access to… Ibm
- CVE-2026-12091 LOW · 3.7 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a denial of service due to a heap-based… Ibm
- CVE-2026-11939 LOW · 2.7 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery. Ibm
- CVE-2026-11936 MEDIUM · 4.9 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting.… Ibm
- CVE-2026-11930 MEDIUM · 5.9 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may not enforce authorization correctly for some web servers. Ibm
- CVE-2026-11888 MEDIUM · 6.4 IBM Security Verify Access 10.0 tot en met 10.0.9.2 en IBM Verify Identity Access 11.0 tot en met 11.0.3 is kwetsbaar voor een aanval op… Ibm
- CVE-2026-11318 HIGH · 7.8 Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root…
- CVE-2026-107782 HIGH · 7.8 System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any…
- CVE-2026-107781 HIGH · 7.4 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary…
- CVE-2026-107780 CRITICAL · 9.8 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single…
- CVE-2026-107779 CRITICAL · 9.8 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL,…
- CVE-2026-107778 MEDIUM · 6.5 MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending…
- CVE-2026-107708 MEDIUM · 4.9 MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed…
- CVE-2026-107397 MEDIUM · 4.4 Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers…
- CVE-2026-107318 HIGH · 7.4 @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS…
- CVE-2026-106435 MEDIUM · 5.1 The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing…