CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-102258 MEDIUM · 6.1 Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote…
- CVE-2026-102257 HIGH · 7.2 A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory…
- CVE-2026-98374 HIGH · 8.8 In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() When tcp_send_synack() replaces the cloned SYN skb at…
- CVE-2026-98373 NONE In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: preserve mremap address delta when skipping page tables move_hugetlb_page_tables() optimizes mremap() by advancing to…
- CVE-2026-42532 MEDIUM · 5.5 A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .eml file can lead to arbitrary…
- CVE-2026-41958 MEDIUM · 6.5 A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .zip file can lead to…
- CVE-2026-107180 NONE Op MISP-instanties die zijn geconfigureerd om TOTP-inschrijving te vereisen (Security.otp_required), is de handhaving van de verplichte tweefactorauthenticatie alleen van toepassing op standaard browserverzoeken. Een geverifieerde…
- CVE-2026-107177 MEDIUM · 5.9 Express Gateway via 1.16.11 bevat een hardgecodeerde cryptografische sleutelkwetsbaarheid waarmee aanvallers met datastore-toegang opgeslagen OAuth 2.0-tokengeheimen kunnen ontsleutelen via de standaard crypto.cipherKey 'sensitiveKey'. Aanvallers die…
- CVE-2026-107175 NONE Misp bevat een defect in de workflow voor het opslaan van gebeurtenissen waardoor de correlatie-engine correlaties niet opnieuw kan berekenen wanneer het distributieniveau of de…
- CVE-2026-107170 LOW · 2.9 Er werd een fout gevonden in m17n-lib. Een gedeeltelijke storing tijdens het initialiseren van de bibliotheek kan een interne driveraanwijzer ongeïnitialiseerd laten. Onder specifieke foutcondities,…
- CVE-2026-107168 MEDIUM · 6.2 Er werd een fout gevonden in m17n-lib. Door vervaardigde invoer te leveren die een ongeldige UTF-8-tekenreeks bevat, kan een aanvaller ervoor zorgen dat de tekstparseerfunctie…
- CVE-2026-107162 MEDIUM · 6.8 Express Gateway via 1.16.11 bevat een kwetsbaarheid voor het omzeilen van authenticatie in de OAuth 2.0 refresh_token-subsidie die het tokengeheim of de uitgevende client niet…
- CVE-2026-107151 MEDIUM · 5.9 Ontbrekende authenticatie is gevonden in taakupdates voor uitvoering op afstand in het smart_proxy_dynflow-pakket. De voortgangs- en voltooiingsoproepen accepteren een rapport wanneer het eenmalige token ontbreekt.…
- CVE-2026-105140 MEDIUM · 4.2 Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in…
- CVE-2026-105139 MEDIUM · 4.3 Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components.…
- CVE-2026-105138 MEDIUM · 6.5 Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins…
- CVE-2026-103435 NONE Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without…
- CVE-2026-102256 HIGH · 7.8 Onjuiste neutralisatie van speciale elementen die worden gebruikt in een kwetsbaarheid van een besturingssysteemcommando ('OS Command Injection') is geïdentificeerd in het SMA1000-apparaat, waardoor een op…
- CVE-2026-102255 CRITICAL · 10.0 A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote…
- CVE-2026-42710 HIGH · 7.6 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects…
- CVE-2026-42708 HIGH · 7.6 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue…
- CVE-2026-107159 MEDIUM · 6.5 MiniUPnPd tot en met 2.3.11 gebouwd met --strict bevat een kwetsbaarheid van delen door nul in ProcessSSDPData () waarmee niet-geverifieerde lokale netwerkaanvallers de daemon kunnen…
- CVE-2026-106059 HIGH · 8.8 GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the…
- CVE-2026-106058 HIGH · 7.5 GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter…
- CVE-2026-106057 HIGH · 7.8 patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames.…
- CVE-2026-106056 HIGH · 7.5 Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying…
- CVE-2026-96408 CRITICAL · 9.4 A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or…
- CVE-2026-92533 NONE Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated…
- CVE-2026-92532 NONE Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges could modify the application configuration to store files in a…
- CVE-2026-92531 NONE Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into…
- CVE-2026-42714 HIGH · 7.6 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por Piggly (para Woocommerce) pix-por-piggly allows Blind SQL…
- CVE-2026-42713 HIGH · 7.6 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows Blind SQL Injection.This issue…
- CVE-2026-103668 HIGH · 8.6 An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query…
- CVE-2026-97294 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary…
- CVE-2026-97146 NONE Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has…
- CVE-2026-92393 NONE Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined…
- CVE-2026-78243 NONE Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the…
- CVE-2026-42721 HIGH · 7.6 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects…
- CVE-2026-42720 HIGH · 7.6 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue…
- CVE-2026-27434 MEDIUM · 5.3 Ontbrekende autorisatiekwetsbaarheid in sc Internet Vivoo WP Rentals wprentals maakt het mogelijk om onjuist geconfigureerde toegangscontrolebeveiligingsniveaus te exploiteren. Dit probleem heeft invloed op WP Rentals:…
- CVE-2026-105884 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy…
- CVE-2026-105876 MEDIUM · 5.3 Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11.
- CVE-2026-105875 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects…
- CVE-2026-105873 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack…
- CVE-2026-105871 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack…
- CVE-2026-105192 CRITICAL · 9.8 LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that…
- CVE-2026-104393 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons…
- CVE-2026-104391 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And…
- CVE-2026-104390 MEDIUM · 4.3 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27.
- CVE-2026-103075 MEDIUM · 4.3 Een beveiligingslek in WPMU DEV Hustle wordpress-popup, veroorzaakt door ontbrekende autorisatie, maakt het mogelijk om misbruik te maken van onjuist geconfigureerde toegangsrechten. Dit probleem treft…