CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-107584 HIGH · 7.4 Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SMTP delivery. The server's validating DNSSEC resolver treated a TLSA…
- CVE-2026-107583 MEDIUM · 6.5 Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to…
- CVE-2026-107582 MEDIUM · 6.5 Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive Robot hMailServer allows a remote…
- CVE-2026-107581 MEDIUM · 6.5 Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number…
- CVE-2026-107580 MEDIUM · 6.5 Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the…
- CVE-2026-107579 HIGH · 7.5 Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery…
- CVE-2026-107578 MEDIUM · 6.7 Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a…
- CVE-2026-107577 HIGH · 7.5 Inefficiënte algoritmische complexiteit en een niet-beëindigende lus in de MIME-verwerking van ontvangen berichten in Progressive Robot hMailServer 6.0.0 tot 6.3.5 stellen een externe niet-geverifieerde aanvaller…
- CVE-2026-107576 HIGH · 7.5 Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make…
- CVE-2026-107575 MEDIUM · 5.3 Inefficiënte algoritmische complexiteit in de SPF-macro-uitbreiding van Progressive Robot hMailServer 6.3.4 en 6.3.5 stelt een externe niet-geverifieerde aanvaller in staat om doorlooptijd van werknemers te…
- CVE-2026-107574 HIGH · 7.5 Inefficiënte algoritmische complexiteit in de JSON-lezer van Progressive Robot hMailServer stelt een niet-geverifieerde aanvaller op afstand in staat om de e-mailservices niet beschikbaar te maken.…
- CVE-2026-107573 HIGH · 7.8 Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data.…
- CVE-2026-107572 MEDIUM · 6.5 Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable…
- CVE-2026-107570 LOW · 2.5 heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.
- CVE-2026-107275 MEDIUM · 6.8 @fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge…
- CVE-2026-93509 MEDIUM · 6.5 The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance…
- CVE-2026-105190 MEDIUM · 5.3 The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to…
- CVE-2026-104704 HIGH · 7.4 Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE…
- CVE-2026-104671 MEDIUM · 5.3 The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to…
- CVE-2026-104660 HIGH · 7.8 Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer credential read and…
- CVE-2026-104659 HIGH · 7.5 Ontbrekende Host-headervalidatie en ontbrekende beperking van mislukte aanmeldingen van beheerders in de REST API-listener van Progressive Robot hMailServer 6.0.0 tot en met 6.3.5 stellen een…
- CVE-2026-104658 HIGH · 7.8 De Linux live-update apply helper (hmailserver-update) van Progressive Robot hMailServer 6.3.4 en 6.3.5 wordt als root uitgevoerd op een aanvraagbestand dat is geschreven door het…
- CVE-2026-103649 HIGH · 7.5 Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so…
- CVE-2026-103647 HIGH · 8.0 Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to…
- CVE-2026-103517 MEDIUM · 5.3 The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no…
- CVE-2026-103011 MEDIUM · 6.5 Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user…
- CVE-2026-103010 HIGH · 7.8 Op heap gebaseerde bufferoverloop in de legacy Blowfish-decoderingsroutine (BlowFishEncryptor:: DecryptFromString) in Progressive Robot hMailServer 6.0.0 tot 6.3.3 op Windows stelt een lokale interactieve gebruiker zonder…
- CVE-2026-107510 CRITICAL · 9.1 An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.
- CVE-2026-107503 NONE URL van niet-gevalideerde omgevingen staat OAuth-autorisatiecode + PKCE-verificatiediefstal en accountovername toe via geïnjecteerde OIDC-autoriteit in Ditto Explorer in Eclipse Ditto Ditto Explorer [3.6.0,3.9.7] staat een…
- CVE-2026-89191 MEDIUM · 6.8 Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side…
- CVE-2026-71896 MEDIUM · 6.5 An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint…
- CVE-2026-71895 HIGH · 7.1 An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains…
- CVE-2026-71183 HIGH · 7.1 An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and…
- CVE-2026-66087 HIGH · 8.1 Een beveiligingslek voor het omzeilen van autorisaties in Apache DolphinScheduler stelt geverifieerde gebruikers in staat om taakinstantie te gebruiken in projecten waartoe ze geen toegang…
- CVE-2026-66084 HIGH · 8.1 An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream…
- CVE-2026-66082 MEDIUM · 6.5 An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects.…
- CVE-2026-4894 NONE A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the…
- CVE-2026-12260 NONE SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable…
- CVE-2026-105110 CRITICAL · 9.8 OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root…
- CVE-2026-93699 NONE Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.
- CVE-2026-107466 MEDIUM · 6.1 A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to…
- CVE-2026-87428 HIGH · 7.8 In Brocade ASCG vóór 3.5.0 kan een lokale onbevoegde gebruiker op de ASCG VM die een verzoek kan indienen bij de naamruimte van het SANnav-hostnetwerk,… Broadcom
- CVE-2026-87426 MEDIUM · 4.3 An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed… Broadcom
- CVE-2026-87425 MEDIUM · 6.8 An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate… Broadcom
- CVE-2026-87424 HIGH · 8.8 A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to… Broadcom
- CVE-2026-85490 HIGH · 8.8 When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive… Broadcom
- CVE-2026-85489 HIGH · 8.8 An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions,… Broadcom
- CVE-2026-85488 HIGH · 7.8 Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access… Broadcom
- CVE-2026-85487 HIGH · 8.8 A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send… Broadcom
- CVE-2026-85486 HIGH · 8.0 Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted… Broadcom