CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-97720 CRITICAL · 9.1 Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by…
- CVE-2026-93684 MEDIUM · 5.4 An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it…
- CVE-2026-93026 NONE This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.
- CVE-2026-90466 MEDIUM · 6.5 Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified… Apache
- CVE-2026-89417 HIGH · 7.2 De OMGF | AVG/DSGVO-conforme, snellere Google-lettertypen. Easy. plugin voor WordPress is kwetsbaar voor Stored Cross-Site Scripting via's' Search Parameter via comments-atom Feed in alle versies…
- CVE-2026-5703 NONE Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user…
- CVE-2026-58069 NONE This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.
- CVE-2026-58068 NONE This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.
- CVE-2026-19186 HIGH · 8.1 ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without first checking that the received frame is at least ll_hdr_len + authtag_len bytes…
- CVE-2026-15894 HIGH · 8.8 The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source…
- CVE-2026-107104 NONE Deze kwetsbaarheid bestaat in het ERP-systeem als gevolg van onveilige deserialisatie van door de gebruiker gecontroleerde gegevens in de betreffende functionaliteit. Een niet-geverifieerde externe aanvaller…
- CVE-2026-107103 NONE Deze kwetsbaarheid bestaat in het ERP-systeem vanwege onvoldoende validatie en parametrering van door de gebruiker geleverde invoer in een API-eindpunt. Een niet-geverifieerde externe aanvaller zou…
- CVE-2026-107102 NONE Deze kwetsbaarheid bestaat in het ERP-systeem als gevolg van onjuiste validatie van terugbelparameters voor betalingen en ontoereikende authenticatiecontroles in API-eindpunt. Een niet-geverifieerde externe aanvaller zou…
- CVE-2026-103416 NONE Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache…
- CVE-2026-102782 NONE Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check…
- CVE-2026-102781 NONE Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired through Joomla’s core com_ajax dispatcher, is the single…
- CVE-2025-64393 NONE This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
- CVE-2025-64392 NONE This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.
- CVE-2025-64391 NONE This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator…
- CVE-2026-107121 MEDIUM · 6.5 Er is een fout gevonden in de SMTP-e-mailconfiguratieafhandeling van de keycloak-services-component. Wanneer de STARTTLS-optie is ingeschakeld, slaagt Keycloak er niet in om een versleutelde verbinding…
- CVE-2026-97354 MEDIUM · 4.1 The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users…
- CVE-2026-97331 MEDIUM · 4.3 The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that…
- CVE-2026-97188 HIGH · 8.8 The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database…
- CVE-2026-96530 MEDIUM · 6.5 The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any…
- CVE-2026-87971 HIGH · 7.1 The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on…
- CVE-2026-87782 HIGH · 8.8 The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with…
- CVE-2026-86833 MEDIUM · 5.4 De MetForm WordPress-plug-in vóór 4.3.1 ontsmet of ontsnapt niet aan ingediende formulierveldwaarden voordat deze in de HTML-body van de e-mailmeldingen zijn ingevoegd, waardoor niet-geverifieerde aanvallers…
- CVE-2026-86816 MEDIUM · 5.3 The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data,…
- CVE-2026-82212 HIGH · 7.5 The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the…
- CVE-2026-82211 HIGH · 8.2 The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark…
- CVE-2026-105322 MEDIUM · 5.3 The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary…
- CVE-2026-105316 HIGH · 7.1 The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated…
- CVE-2026-104953 MEDIUM · 6.8 The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users…
- CVE-2026-104678 LOW · 2.7 The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to…
- CVE-2026-104677 HIGH · 7.2 The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that…
- CVE-2026-104667 MEDIUM · 6.8 The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a…
- CVE-2026-104653 MEDIUM · 6.8 The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an…
- CVE-2026-104652 MEDIUM · 6.8 The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing…
- CVE-2026-104651 MEDIUM · 4.3 De Yaad Sarig Payment Gateway For WC WordPress-plug-in vóór 2.2.13 verifieert de autorisatie niet of dat de verzoekende gebruiker eigenaar is van de doelorder in…
- CVE-2026-104050 MEDIUM · 4.3 The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access…
- CVE-2026-104049 MEDIUM · 4.3 The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST…
- CVE-2026-103681 MEDIUM · 4.3 The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges,…
- CVE-2026-103378 MEDIUM · 6.5 The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory,…
- CVE-2026-103323 MEDIUM · 5.9 The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated…
- CVE-2026-59347 HIGH · 8.1 VMware Workstation en Fusion bevatten een stack-based buffer-overflow kwetsbaarheid in HGFS. Een kwaadwillende actor met lokale beheerdersrechten op een virtuele machine kan dit probleem misbruiken…
- CVE-2026-59346 CRITICAL · 9.3 VMware Workstation en Fusion bevatten een kwetsbaarheid voor integer-overflow. Een kwaadwillende actor met lokale beheerdersrechten op een virtuele machine met VMXNET3 virtuele netwerkadapter kan dit…
- CVE-2026-103870 MEDIUM · 5.0 A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user…
- CVE-2026-103869 MEDIUM · 6.5 A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token…
- CVE-2026-103868 MEDIUM · 6.5 A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads…
- CVE-2026-102173 HIGH · 7.2 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions…