CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-107615 HIGH · 7.8 An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM…
- CVE-2026-107614 MEDIUM · 6.1 An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read…
- CVE-2026-107613 MEDIUM · 5.9 A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing…
- CVE-2026-107612 HIGH · 7.8 Onjuiste toestemmingstoewijzing in GlavSoft TightVNC Server voor Windows vóór 2.8.88 stelt een lokale geverifieerde gebruiker in staat om de inter-proces communicatiehandvatten te lezen of te…
- CVE-2026-107611 HIGH · 7.1 An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromised VNC server to read…
- CVE-2026-104634 NONE Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client's JSON true, false and null tool arguments to reach the…
- CVE-2026-103663 NONE Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker…
- CVE-2026-66479 HIGH · 7.1 Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.
- CVE-2026-62142 HIGH · 8.8 Cross-Site Request Forgery (CSRF) -kwetsbaarheid in Melapress WP 2FA wp-2fa staat Cross Site Request Forgery toe. Dit probleem heeft invloed op WP 2FA: van n.v.t.…
- CVE-2026-62128 MEDIUM · 5.3 Ontbrekende kwetsbaarheid voor autorisatie in Creator LMS Creator LMS creatorlms maakt het mogelijk om onjuist geconfigureerde toegangscontrolebeveiligingsniveaus te exploiteren. Dit probleem heeft invloed op Creator…
- CVE-2026-62127 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MediaRon LLC WP Plugin Info Card wp-plugin-info-card allows Stored XSS.This issue affects WP…
- CVE-2026-44038 MEDIUM · 4.4 A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows an attacker…
- CVE-2026-44037 MEDIUM · 5.5 Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion…
- CVE-2026-44036 MEDIUM · 5.5 Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service…
- CVE-2026-44035 MEDIUM · 5.5 Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via…
- CVE-2026-44034 MEDIUM · 4.4 A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory,…
- CVE-2026-44033 MEDIUM · 5.5 Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service…
- CVE-2026-44031 HIGH · 7.5 Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service…
- CVE-2026-19218 CRITICAL · 9.1 Zwakke Password Recovery Mechanism voor Forgotten Password kwetsbaarheid in VERWANTE Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta staat Password Recovery Exploitation toe. Dit…
- CVE-2026-16340 CRITICAL · 9.8 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code… Ibm
- CVE-2026-16182 MEDIUM · 5.9 IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a… Ibm
- CVE-2026-16181 HIGH · 7.4 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass security restrictions… Ibm
- CVE-2026-16179 HIGH · 7.5 IBM DataPower Gateway 10.5.0.0 tot en met 10.5.0.22, 10.6.1 tot en met 10.6.6, 10.6.0.0 tot en met 10.6.0.10 en 11.0.0.0 tot en met 11.0.0.2 kunnen… Ibm
- CVE-2026-16178 HIGH · 7.5 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial… Ibm
- CVE-2026-16177 MEDIUM · 5.3 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive… Ibm
- CVE-2026-16176 HIGH · 7.5 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial… Ibm
- CVE-2026-16170 HIGH · 7.5 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial… Ibm
- CVE-2026-16169 HIGH · 7.5 IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. Ibm
- CVE-2026-14521 MEDIUM · 4.9 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request forgery (SSRF). This may allow… Ibm
- CVE-2026-106611 HIGH · 7.1 Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.
- CVE-2026-106603 MEDIUM · 6.5 Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HollerBox: from n/a through 2.3.14.
- CVE-2026-106600 MEDIUM · 5.3 Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through 4.18.0.
- CVE-2026-106596 MEDIUM · 5.3 Ontbrekende autorisatiekwetsbaarheid in Visual Composer Visual Composer Website Builder visualcomposer maakt het mogelijk om onjuist geconfigureerde toegangscontrolebeveiligingsniveaus te exploiteren. Dit probleem heeft invloed op Visual…
- CVE-2026-105893 MEDIUM · 5.3 Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through…
- CVE-2026-105891 MEDIUM · 4.3 Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a…
- CVE-2026-105890 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This…
- CVE-2026-105888 MEDIUM · 5.4 Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a…
- CVE-2026-105887 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robosoft Robo Gallery robo-gallery allows Stored XSS.This issue affects Robo Gallery: from n/a…
- CVE-2026-105886 MEDIUM · 6.5 Missing Authorization vulnerability in BdThemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Post Kit: from n/a through…
- CVE-2026-105878 MEDIUM · 5.3 Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from…
- CVE-2026-105079 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a…
- CVE-2026-105078 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Store Locator WP Store Locator wp-store-locator allows Stored XSS.This issue affects WP…
- CVE-2026-105076 HIGH · 7.6 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from…
- CVE-2026-103072 MEDIUM · 4.3 Missing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VillaTheme Core: from n/a through 1.0.5.
- CVE-2026-103070 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Stored XSS.This issue affects ShortPixel Image Optimizer:…
- CVE-2026-102784 NONE Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only…
- CVE-2026-102783 NONE Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper…
- CVE-2026-92555 CRITICAL · 9.8 Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data…
- CVE-2026-19083 HIGH · 8.8 Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs.…
- CVE-2026-107587 MEDIUM · 5.9 Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account…