CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-107322 HIGH · 7.8 An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary…
- CVE-2026-106438 MEDIUM · 4.0 An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This…
- CVE-2026-106437 MEDIUM · 6.2 The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can…
- CVE-2026-106434 MEDIUM · 4.3 The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify…
- CVE-2026-106433 HIGH · 8.8 Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate…
- CVE-2026-106431 MEDIUM · 5.7 An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when…
- CVE-2026-106430 MEDIUM · 5.9 The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause…
- CVE-2026-106429 MEDIUM · 6.5 Een integer underflow in de KMS endpoint-parsing logica van MongoDB libmongocrypt kan een toewijzingsfout veroorzaken die het aanvraagproces beëindigt. Dit kan gebeuren wanneer een geverifieerde…
- CVE-2026-106428 LOW · 3.7 An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed…
- CVE-2026-105570 NONE Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside…
- CVE-2026-105452 NONE Docker-sandboxen kunnen een door de klant geleverde inloggegevens doorsturen naast een inloggegevens die zijn geïnjecteerd door de host-uitgangsproxy. De proxy heeft alternatieve referenties alleen verwijderd…
- CVE-2026-101998 NONE Docker-sandboxen kunnen openvallen tijdens het maskeren van inloggegevens in beveiligde proxy-antwoorden. Wanneer een response-body gelezen geretourneerde gegevens samen met een fout, konden getroffen handlers ongemaskeerde…
- CVE-2026-97147 NONE In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource,…
- CVE-2026-95210 MEDIUM · 4.8 GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an ASN.1 NULL (05 00) instead…
- CVE-2026-95184 MEDIUM · 5.9 GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=Evil accepted although outside permitted O=Good." NOTE: the…
- CVE-2026-93861 NONE In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further…
- CVE-2026-93860 NONE In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder…
- CVE-2026-93858 NONE In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection to a gateway or target…
- CVE-2026-62171 NONE Reden van afwijzing: Deze CVE is een duplicaat van een andere CVE.
- CVE-2026-62170 NONE Reden van afwijzing: Deze CVE is een duplicaat van een andere CVE.
- CVE-2026-107702 MEDIUM · 4.3 QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter.…
- CVE-2026-107698 MEDIUM · 5.4 FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the… Ffmpeg
- CVE-2026-107697 MEDIUM · 4.3 FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists.… Ffmpeg
- CVE-2026-107696 MEDIUM · 6.5 FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP… Ffmpeg
- CVE-2026-107695 MEDIUM · 6.5 FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master… Ffmpeg
- CVE-2026-107380 MEDIUM · 5.4 savg-sanitizer is een PHP SVG/XML sanitizer. Voorafgaand aan 1.0.0 valideert de isHrefSafeValue () van svg-sanitizer een SVG href na XML DTD-entiteitsuitbreiding, maar saveXML() serialiseert de…
- CVE-2026-107379 MEDIUM · 6.5 savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a…
- CVE-2026-107378 NONE CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments…
- CVE-2026-107377 HIGH · 7.5 datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN…
- CVE-2026-107376 HIGH · 8.2 webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQLLanguageParser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and…
- CVE-2026-107375 HIGH · 8.8 JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with…
- CVE-2026-107362 HIGH · 7.1 The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL and returns the response to the caller. An…
- CVE-2026-107361 MEDIUM · 4.2 The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header…
- CVE-2026-107337 HIGH · 7.1 The Malcolm kiosk Flask application exposes a POST /script_call/ endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to…
- CVE-2026-107336 MEDIUM · 6.5 Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path…
- CVE-2026-107335 MEDIUM · 6.5 Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the…
- CVE-2026-107334 MEDIUM · 5.4 Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload…
- CVE-2026-107333 HIGH · 8.1 Malcolm's op nginx gebaseerde reverse proxy bevat een URL-padnormalisatie-inconsistentie tussen de op Lua gebaseerde op rollen gebaseerde toegangsbeheer (RBAC) autorisatielaag en de eigen aanvraagrouteringslogica van…
- CVE-2026-107332 MEDIUM · 5.5 Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via…
- CVE-2026-107303 HIGH · 7.6 JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated…
- CVE-2026-107302 HIGH · 7.5 msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before…
- CVE-2026-88647 MEDIUM · 6.5 GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value…
- CVE-2026-62167 NONE Reden van afwijzing: Deze CVE is een duplicaat van een andere CVE.
- CVE-2026-62166 NONE Reden van afwijzing: Deze CVE is een duplicaat van een andere CVE.
- CVE-2026-62163 NONE Rejected reason: Reason: This candidate is a duplicate of CVE-2026-60089.
- CVE-2026-61801 MEDIUM · 5.5 Het pakket `github.com/moby/sys/user` biedt Go-hulpprogramma's voor het parseren en opzoeken van vermeldingen in Unix-achtige gebruikers- en groepsdatabasebestanden. Versies vóór 0.4.1 beperken de invoer niet voldoende…
- CVE-2026-50055 MEDIUM · 6.5 A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies…
- CVE-2026-50054 HIGH · 7.1 An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right,…
- CVE-2026-10631 MEDIUM · 6.5 An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete…
- CVE-2026-107709 HIGH · 7.8 A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/decompress-zip.js` improperly validates archive entry paths during ZIP extraction. A…