CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-19572 NONE A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an…
- CVE-2026-84897 MEDIUM · 5.3 src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and SSH_MSG_KEX_DH_GEX_REPLY (33) when a server receives them from an… Wolfssh
- CVE-2026-83742 HIGH · 8.8 Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one… Wolfssh
- CVE-2026-83540 HIGH · 8.8 When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not… Wolfssh
- CVE-2026-81535 CRITICAL · 9.1 In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in… Wolfssh
- CVE-2026-16516 HIGH · 7.4 wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c),… Wolfssh
- CVE-2026-14911 NONE Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings,…
- CVE-2026-106061 MEDIUM · 5.5 A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel…
- CVE-2026-19396 NONE A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user…
- CVE-2026-19386 NONE A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that…
- CVE-2026-16528 NONE Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log,…
- CVE-2026-106471 HIGH · 8.1 A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring…
- CVE-2026-105324 NONE An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a…
- CVE-2026-102478 NONE In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation.…
- CVE-2026-97680 HIGH · 8.3 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control… Langflow
- CVE-2026-97679 HIGH · 8.8 IBM Langflow Oss 1.0.0 tot en met 1.12.2 kan een op afstand geverifieerde aanvaller in staat stellen willekeurige code uit te voeren vanwege onjuiste neutralisatie… Langflow
- CVE-2026-97678 HIGH · 8.8 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation. Langflow
- CVE-2026-97676 HIGH · 8.8 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in… Langflow
- CVE-2026-97674 HIGH · 8.1 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used… Langflow
- CVE-2026-97673 HIGH · 8.8 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation. Langflow
- CVE-2026-97671 MEDIUM · 6.5 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability. Langflow
- CVE-2026-97655 HIGH · 8.8 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner. Langflow
- CVE-2026-93679 MEDIUM · 4.3 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during ZIP… Langflow
- CVE-2026-93678 HIGH · 7.6 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Langflow
- CVE-2026-93677 HIGH · 7.7 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to an unauthorized… Langflow
- CVE-2026-93675 HIGH · 8.8 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion. Langflow
- CVE-2026-93674 CRITICAL · 9.8 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an… Langflow
- CVE-2026-93449 HIGH · 8.5 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. Langflow
- CVE-2026-93448 MEDIUM · 6.5 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a… Langflow
- CVE-2026-93447 HIGH · 7.5 IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized… Langflow
- CVE-2026-93445 HIGH · 8.1 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Langflow
- CVE-2026-93443 HIGH · 7.5 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in… Langflow
- CVE-2026-88962 HIGH · 8.8 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. Langflow
- CVE-2026-104334 CRITICAL · 9.8 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation. Langflow
- CVE-2026-103360 HIGH · 8.1 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a… Langflow
- CVE-2026-101331 HIGH · 7.7 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials. Langflow
- CVE-2026-101329 MEDIUM · 6.5 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control. Langflow
- CVE-2026-80048 MEDIUM · 5.5 Er is een fout gevonden in `sssd-kcm`. Een lokale gebruiker of proces dat in staat is om verbinding te maken met de `sssd-kcm` UNIX-socket kan…
- CVE-2026-106583 LOW · 2.5 In ssh in OpenSSH vóór 10.6 kan een $ of teken voorkomen in een opdrachtregelgebruikersnaam, wat leidt tot injectie. Openbsd
- CVE-2026-104335 HIGH · 8.8 IBM Langflow Oss 1.0.0 tot en met 1.12.2 kan een op afstand geverifieerde aanvaller in staat stellen om willekeurige code uit te voeren vanwege onjuiste… Langflow
- CVE-2026-97626 MEDIUM · 4.3 Het aanvragen van een gebruikers- of organisatieprofielpagina (`GET /{username}`) met de kop `Accept: application/rss+xml` of `Accept: application/atom+xml` leverde de activiteitsfeed van de eigenaar op zonder…
- CVE-2026-97208 MEDIUM · 4.9 Het Gitea API-eindpunt voor het maken van push-spiegels (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) controleerde alleen of spiegelen was ingeschakeld en niet de instelling `[mirror] DISABLE_NEW_PUSH` die de webinterface… Gitea
- CVE-2026-96594 MEDIUM · 6.1 Het Gitea API-eindpunt `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` schreef bestanden van maximaal 1 KiB die rechtstreeks in Git worden opgeslagen, niet in LFS, naar de reactie zonder het… Gitea
- CVE-2026-89182 MEDIUM · 5.4 Met `[repository] FORCE_PRIVATE = true` maakt Gitea nieuwe repositories aan als privé, maar de post-receive hook paste nog steeds de push-optie `repo.private =false` toe op… Gitea
- CVE-2026-86684 HIGH · 7.1 De Gitea push mirror API controleerde of de eigenaar van de repository, in plaats van de verzoekende gebruiker, lokale bestandssysteempaden mag gebruiken. Op instanties met… Gitea
- CVE-2026-65142 HIGH · 7.8 NVIDIA Model-Optimizer bevat een kwetsbaarheid waarbij een aanvaller deserialisatie van niet-vertrouwde gegevens kan veroorzaken. Een succesvolle exploitatie van deze kwetsbaarheid kan leiden tot code-uitvoering, sabotage…
- CVE-2026-65122 MEDIUM · 5.5 NVIDIA TensorRT bevat een kwetsbaarheid waarbij een aanvaller een out of bounds read kan veroorzaken. Een succesvolle uitbuiting van deze kwetsbaarheid kan leiden tot denial…
- CVE-2026-106589 LOW · 2.9 In sshd in OpenSSH tot 10.6, in bepaalde omgevingen zoals QNX 6 en SCO OpenServer 5, kan sshd-sessie onverwacht rootprivileges hebben. Dit heeft te maken…
- CVE-2026-106588 LOW · 3.1 In sshd in OpenSSH tot en met 10.6 heeft het gebruik van de macOS 27 (of hoger) SDK het neveneffect van verlies van sandboxing, wat…
- CVE-2026-106587 LOW · 3.6 In sshd in OpenSSH vóór 10.6 wordt de waarde "none" voor een configuratieoptie soms geïnterpreteerd als een bestandsnaam, maar was bedoeld om aan te geven… Openbsd