CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-106572 MEDIUM · 5.3 ImageMagick is gratis en open-source software die wordt gebruikt voor het bewerken en manipuleren van digitale afbeeldingen. Voorafgaand aan 7.1.2-30 en 6.9.13-55 staat een ontbrekende…
- CVE-2026-106571 MEDIUM · 5.1 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted local call to the GetVirtualPixels…
- CVE-2026-106570 MEDIUM · 4.3 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeatedly connect to the…
- CVE-2026-106569 MEDIUM · 5.3 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder…
- CVE-2026-106568 MEDIUM · 5.3 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an…
- CVE-2026-106567 MEDIUM · 5.9 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an…
- CVE-2026-106566 MEDIUM · 4.0 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment…
- CVE-2026-106565 MEDIUM · 5.9 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed…
- CVE-2026-106564 MEDIUM · 5.3 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder…
- CVE-2026-77214 HIGH · 8.2 libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied…
- CVE-2026-62179 MEDIUM · 6.5 PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency…
- CVE-2026-46570 HIGH · 8.1 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g… Tuxera
- CVE-2026-107202 CRITICAL · 9.1 Er bestaat een kwetsbaarheid voor opdrachtinjectie in de administratieve API van h-ui (versie v0.0.25 en lager) vanwege onjuiste validatie van het veld luisterconfiguratie. Wanneer een…
- CVE-2026-107174 MEDIUM · 6.4 Er werd een fout gevonden in bron-tot-beeld. Bij het uitpakken van archiefbestanden ontsmet de applicatie symbolische links die verwijzen naar absolute bestandspaden niet goed. Een…
- CVE-2026-107169 MEDIUM · 6.2 Er werd een fout gevonden in m17n-lib. Een aanvaller kan speciaal ontworpen of afgekorte UTF-8-invoer leveren om een onbehandelde null pointer-dereferentie te activeren tijdens de…
- CVE-2026-107167 MEDIUM · 6.2 Er werd een fout gevonden in m17n-lib. Een gebruiker die speciaal vervaardigde tekstinvoer levert, kan een heap use-after-free conditie activeren tijdens de statusovergangen van de…
- CVE-2026-107125 MEDIUM · 6.3 Er is een fout gevonden in XnView Classic 2.52.5. Beïnvloed is een onbekende functie van de component FLI File Parser. Deze manipulatie van het argument…
- CVE-2026-106563 MEDIUM · 5.3 Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services…
- CVE-2026-106562 MEDIUM · 4.3 Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents…
- CVE-2026-106561 MEDIUM · 5.0 Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive information disclosure in kubernetes resource queries.…
- CVE-2026-106560 HIGH · 7.1 Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder…
- CVE-2026-106559 MEDIUM · 6.3 Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper input validation in confluence to markdown…
- CVE-2026-106558 HIGH · 8.8 Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated… Linuxfoundation
- CVE-2026-106556 HIGH · 7.7 Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient… Linuxfoundation
- CVE-2026-106510 HIGH · 7.7 Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in… Linuxfoundation
- CVE-2026-106064 MEDIUM · 6.3 A heap-based buffer overflow was found in GIMP’s GIF export plug-in. Exporting an image with very large width and height can cause 32-bit overflow when…
- CVE-2026-104074 MEDIUM · 5.3 Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without…
- CVE-2025-70522 HIGH · 8.8 De request handler van Fanvil x7a firmware versie 2.6.0.1182 dwingt geen cross-origin bronbescherming af voor een statusveranderend verzoek dat wordt uitgevoerd tegen de applicaties. Vanwege…
- CVE-2025-70521 CRITICAL · 9.8 The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input…
- CVE-2025-70520 NONE De websocket-handler van Fanvil x7a firmware versie 2.6.0.1182 legt geen juiste authenticatiebeperkingen op aan sessieloze gebruikers. Het gebrek aan beperkingen geeft iedereen de mogelijkheid om…
- CVE-2025-70519 MEDIUM · 6.1 The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows…
- CVE-2025-70518 CRITICAL · 10.0 The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input…
- CVE-2025-70517 HIGH · 8.8 De request handler van Fanvil x7a firmware versie 2.6.0.1182 dwingt geen cross-origin bronbescherming af voor een statusveranderend verzoek dat wordt uitgevoerd tegen de applicaties. Vanwege…
- CVE-2025-70516 CRITICAL · 9.1 De websocket-handler van Fanvil x7a firmware versie 2.6.0.1182 legt geen juiste authenticatiebeperkingen op aan sessieloze gebruikers. Het gebrek aan beperkingen geeft iedereen de mogelijkheid om…
- CVE-2025-70515 NONE The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows…
- CVE-2026-88514 MEDIUM · 5.5 An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.
- CVE-2026-46572 HIGH · 7.4 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g… Tuxera
- CVE-2026-46571 MEDIUM · 5.5 In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory… Tuxera
- CVE-2026-46569 HIGH · 7.7 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g… Tuxera
- CVE-2026-46438 MEDIUM · 6.5 wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other…
- CVE-2026-46437 MEDIUM · 4.8 wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger` where bearer-style API…
- CVE-2026-46434 HIGH · 7.1 wger is een gratis, open-source trainings- en fitnessmanager. Voorafgaand aan versie 2.6 kan een gebruiker met alleen de toestemming `gym_trainer` elk account in dezelfde sportschool…
- CVE-2026-45161 MEDIUM · 5.4 wger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts GET requests and executes `django_login()` without…
- CVE-2026-43976 HIGH · 7.1 wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard (`gym_a…
- CVE-2026-42618 HIGH · 7.1 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in… Tuxera
- CVE-2026-42617 HIGH · 7.1 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g… Tuxera
- CVE-2026-42616 HIGH · 7.8 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfscat binary… Tuxera
- CVE-2026-107194 NONE Sungrow iSolarCloud vóór 2026 staat authenticatie-bypass en accountovername toe via "login_type":"5" in een inlogverzoek, wat mogelijk leidt tot "lokale black-outs op het hele continent" in…
- CVE-2026-107183 HIGH · 8.1 llama.cpp voor b11393 bevat een use-after-free en dubbele gratis kwetsbaarheid in common_chat_peg_mapper::map waarmee niet-geverifieerde externe aanvallers het heap-geheugen kunnen beschadigen via een bungelende current_tool-aanwijzer. Aanvallers…
- CVE-2026-107181 HIGH · 8.1 Telegram Desktop voor 7.2.9 bevat een IPC-recordscheider-injectiekwetsbaarheid in Core::Sandbox waarmee externe aanvallers OPEN: records kunnen injecteren via bewerkte tg:// -koppelingen die niet-ontspoorde puntkomma's bevatten. Aanvallers…