CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-102368 NONE De firmware van het betreffende Tapo-apparaat slaat apparaatspecifiek cryptografisch materiaal op in platte tekst binnen niet-vluchtige opslag. Een aanvaller met fysieke toegang tot een getroffen…
- CVE-2026-101024 HIGH · 8.8 Satel Netco Design-versies voorafgaand aan v2.1.7 bevatten een relatieve kwetsbaarheid in de gegevensexportfunctionaliteit. Een geverifieerde gebruiker met Viewer-privileges kan door aanvallers beïnvloede inhoud schrijven naar…
- CVE-2026-84275 HIGH · 7.5 IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary… Ibm
- CVE-2026-84274 MEDIUM · 6.5 IBM Guardium Data Protection 12.2.2 is affected by a sensitive information exposure vulnerability. During SECRET and API_KEY rotation processing, sensitive credential material is logged at… Ibm
- CVE-2026-84272 CRITICAL · 9.8 IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to… Ibm
- CVE-2026-84271 HIGH · 7.8 IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability… Ibm
- CVE-2026-84250 HIGH · 8.4 IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component. A local attacker… Ibm
- CVE-2026-84245 HIGH · 7.8 IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cp_wrapper component. A low-privileged local user could exploit this vulnerability to… Ibm
- CVE-2026-84244 CRITICAL · 9.3 IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scripting (XSS) in the Quick Search results grid. An unauthenticated… Ibm
- CVE-2026-82344 HIGH · 8.1 IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can… Ibm
- CVE-2026-82335 HIGH · 8.1 IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a… Ibm
- CVE-2026-82334 HIGH · 8.1 IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a… Ibm
- CVE-2026-107707 HIGH · 7.8 Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as…
- CVE-2026-107706 MEDIUM · 4.3 Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only…
- CVE-2026-107705 MEDIUM · 6.5 Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted…
- CVE-2026-107608 MEDIUM · 5.5 Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files…
- CVE-2026-107396 MEDIUM · 5.4 Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create…
- CVE-2026-107395 MEDIUM · 4.3 Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy…
- CVE-2026-107394 MEDIUM · 6.8 Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not…
- CVE-2026-107393 MEDIUM · 6.1 FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login…
- CVE-2026-107392 MEDIUM · 6.2 music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without… Borewit
- CVE-2026-107391 MEDIUM · 6.2 music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4… Borewit
- CVE-2026-107390 MEDIUM · 6.2 music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts… Borewit
- CVE-2026-107389 MEDIUM · 6.2 music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element…
- CVE-2026-106436 MEDIUM · 4.8 The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the… Mongodb
- CVE-2026-106432 LOW · 3.6 The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string… Mongodb
- CVE-2026-106126 CRITICAL · 9.9 A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as…
- CVE-2026-104076 CRITICAL · 9.1 TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and…
- CVE-2026-104075 CRITICAL · 9.8 TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote…
- CVE-2026-95209 NONE Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that…
- CVE-2026-88648 LOW · 3.7 In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat…
- CVE-2026-84290 MEDIUM · 5.1 IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHOD_NEITHER IOCTL handlers… Ibm Microsoft
- CVE-2026-84278 HIGH · 7.2 IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands… Ibm
- CVE-2026-84276 HIGH · 7.5 IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC… Ibm
- CVE-2026-67693 LOW · 3.7 GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier…
- CVE-2026-40804 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This issue affects aBlocks: from n/a through…
- CVE-2026-107704 CRITICAL · 9.8 The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted…
- CVE-2026-107703 CRITICAL · 9.8 @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers…
- CVE-2026-107701 HIGH · 8.2 dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the…
- CVE-2026-107700 CRITICAL · 9.8 dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is…
- CVE-2026-107699 CRITICAL · 9.8 ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments.…
- CVE-2026-107388 MEDIUM · 6.2 music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the… Borewit
- CVE-2026-107387 MEDIUM · 6.2 music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a… Borewit
- CVE-2026-107386 NONE amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes…
- CVE-2026-107385 HIGH · 7.4 MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always…
- CVE-2026-107384 HIGH · 8.1 MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that…
- CVE-2026-107383 HIGH · 7.5 MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon…
- CVE-2026-107382 MEDIUM · 5.9 MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls…
- CVE-2026-107325 MEDIUM · 5.9 Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate…
- CVE-2026-107324 MEDIUM · 5.9 An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed…