CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-107636 MEDIUM · 6.5 pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled…
- CVE-2026-107635 MEDIUM · 5.5 Dislocker through 0.7.3 contains an integer underflow vulnerability in get_vmk() and get_fvek() that allows attackers to trigger out-of-bounds heap reads via crafted datum sizes. Attackers…
- CVE-2026-107634 MEDIUM · 6.1 Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_dataset() and get_next_datum() that never validate dataset and datum sizes against the metadata allocation. Attackers…
- CVE-2026-107623 MEDIUM · 4.3 A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backchannel logout offline…
- CVE-2026-107604 MEDIUM · 4.9 A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator with only the read-only…
- CVE-2026-107589 HIGH · 7.5 Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.
- CVE-2026-107586 MEDIUM · 4.3 Ongecontroleerde uitzetting in de browsersessie-tabel van de REST API in Progressive Robot hMailServer 6.2.28 tot 6.3.5 stelt een op afstand geverifieerde gebruiker in staat om…
- CVE-2026-107585 MEDIUM · 5.3 Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make…
- CVE-2026-107565 MEDIUM · 5.1 A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup…
- CVE-2026-107286 HIGH · 7.5 Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or… Pydantic
- CVE-2026-105833 HIGH · 7.7 EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccountService that allows users with Email Account scope access to retrieve other users' IMAP…
- CVE-2026-105832 MEDIUM · 4.3 EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a…
- CVE-2026-105831 MEDIUM · 4.3 EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The…
- CVE-2026-105830 HIGH · 7.5 league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() block-start scan. Unauthenticated attackers can…
- CVE-2026-105829 MEDIUM · 6.1 League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML…
- CVE-2026-105828 NONE Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when…
- CVE-2026-105827 NONE Rejected reason: This CVE ID has been rejected as a duplicate.
- CVE-2026-105826 NONE Rejected reason: This CVE ID has been rejected as a duplicate.
- CVE-2026-105825 NONE Rejected reason: This CVE ID has been rejected as a duplicate.
- CVE-2026-105824 NONE Rejected reason: This CVE ID has been rejected as a duplicate.
- CVE-2026-105823 NONE Rejected reason: This CVE ID has been rejected as a duplicate.
- CVE-2026-105405 NONE Rejected reason: This CVE ID has been rejected as a duplicate.
- CVE-2026-105404 NONE Rejected reason: This CVE ID has been rejected as a duplicate.
- CVE-2026-105403 NONE Rejected reason: This CVE ID has been rejected as a duplicate.
- CVE-2026-105402 NONE Rejected reason: This CVE ID has been rejected as a duplicate.
- CVE-2026-105401 NONE Rejected reason: This CVE ID has been rejected as a duplicate.
- CVE-2026-105400 NONE Rejected reason: This CVE ID has been rejected as a duplicate.
- CVE-2026-105399 NONE Rejected reason: This CVE ID has been rejected as a duplicate.
- CVE-2026-105398 NONE Rejected reason: This CVE ID has been rejected as a duplicate.
- CVE-2026-105331 NONE Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle'…
- CVE-2026-91844 HIGH · 7.3 Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files. This issue…
- CVE-2026-89290 LOW · 3.5 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows…
- CVE-2026-88257 NONE Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch function with arguments that violate the input…
- CVE-2026-42698 MEDIUM · 5.3 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from…
- CVE-2026-27420 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Seaborn Zotpress zotpress allows Stored XSS.This issue affects Zotpress: from n/a through…
- CVE-2026-16167 HIGH · 7.5 IBM DataPower Gateway 10.5.0.0 tot en met 10.5.0.22, 10.6.1 tot en met 10.6.6, 10.6.0.0 tot en met 10.6.0.10 en 11.0.0.0 tot en met 11.0.0.2 kunnen… Ibm
- CVE-2026-16165 HIGH · 7.5 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial… Ibm
- CVE-2026-16164 HIGH · 7.5 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial… Ibm
- CVE-2026-16163 HIGH · 8.6 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause memory corruption… Ibm
- CVE-2026-16161 HIGH · 7.5 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial… Ibm
- CVE-2026-16159 HIGH · 8.6 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain sensitive information… Ibm
- CVE-2026-16111 HIGH · 7.5 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of… Ibm
- CVE-2026-15824 HIGH · 8.2 IBM DataPower Gateway 10.5.0.0 tot en met 10.5.0.22, 10.6.1 tot en met 10.6.6, 10.6.0.0 tot en met 10.6.0.10 en 11.0.0.0 tot en met 11.0.0.2 kunnen… Ibm
- CVE-2026-15822 HIGH · 7.5 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial… Ibm
- CVE-2026-15819 HIGH · 7.5 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial… Ibm
- CVE-2026-15784 HIGH · 8.1 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code… Ibm
- CVE-2026-15781 HIGH · 8.0 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary… Ibm
- CVE-2026-15762 CRITICAL · 9.8 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code… Ibm
- CVE-2026-14991 CRITICAL · 9.8 IBM DataPower Gateway 10.5.0.0 tot en met 10.5.0.22, 10.6.1 tot en met 10.6.6, 10.6.0.0 tot en met 10.6.0.10 en 11.0.0.0 tot en met 11.0.0.2 is… Ibm
- CVE-2026-14990 CRITICAL · 9.3 IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI…