CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-102165 HIGH · 7.5 On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service…
- CVE-2026-102164 LOW · 3.1 On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the…
- CVE-2026-102163 HIGH · 8.8 On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame…
- CVE-2026-102162 HIGH · 8.8 On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service…
- CVE-2026-102161 HIGH · 8.8 An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their…
- CVE-2026-102160 HIGH · 7.2 An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and…
- CVE-2026-102159 CRITICAL · 9.8 An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose…
- CVE-2026-102158 MEDIUM · 6.5 Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQL injection against the backend…
- CVE-2026-102157 MEDIUM · 5.9 An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access…
- CVE-2026-102156 MEDIUM · 6.8 Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured…
- CVE-2026-102155 HIGH · 8.5 An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file…
- CVE-2026-101158 HIGH · 8.4 A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful…
- CVE-2026-101157 HIGH · 8.7 A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views…
- CVE-2026-101156 HIGH · 8.4 A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another…
- CVE-2026-101155 CRITICAL · 9.1 An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or…
- CVE-2026-101154 HIGH · 7.2 An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or…
- CVE-2026-101153 HIGH · 8.0 On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this…
- CVE-2026-101152 HIGH · 8.0 Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user,…
- CVE-2026-101151 MEDIUM · 4.3 Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the…
- CVE-2026-101150 MEDIUM · 4.1 Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
- CVE-2026-101149 MEDIUM · 4.1 Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
- CVE-2026-101029 MEDIUM · 4.3 Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated…
- CVE-2026-101027 HIGH · 7.7 When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who…
- CVE-2026-9226 MEDIUM · 6.8 Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account…
- CVE-2026-96890 HIGH · 8.8 Er werd een Server-Side Request Forgery (SSRF) -kwetsbaarheid geïdentificeerd in GitHub Enterprise Server waardoor een bijdrager aan een repository ervoor kon zorgen dat het apparaat… Github
- CVE-2026-86362 HIGH · 8.2 Dell-systeemupdate, versies vóór 2.3.0.0, bevat een kwetsbaarheid voor onjuiste toegangscontrole. Een aanvaller met lage privileges met lokale toegang kan mogelijk misbruik maken van deze kwetsbaarheid,… Dell
- CVE-2026-86361 HIGH · 8.2 Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially… Dell
- CVE-2026-86360 CRITICAL · 9.6 Dell-systeemupdate, versies vóór 2.3.0.0, bevat een onjuiste beperking van een padnaam tot een beveiligingslek in een beperkte map ('Path Traversal'). Een niet-geverifieerde aanvaller met externe… Dell
- CVE-2026-83550 HIGH · 7.1 Er werd een fout gevonden in de postgres-exporteur. Vanwege de lege import van `net/http/pprof` worden debug-eindpunten weergegeven op de niet-geverifieerde metrics-listener. Een externe aanvaller binnen…
- CVE-2026-82162 HIGH · 7.4 Dell Command | Configure (DCC), versies vóór 5.2.3.35, bevatten een onjuist omgaan met een kwetsbaarheid voor gemengde codering. Een niet-geverifieerde aanvaller met toegang op afstand… Dell
- CVE-2026-71168 HIGH · 7.3 Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker… Dell
- CVE-2026-70414 MEDIUM · 5.5 Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially… Dell
- CVE-2026-63697 HIGH · 7.6 Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability,… Dell
- CVE-2026-56952 MEDIUM · 6.7 In platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with…
- CVE-2026-56936 MEDIUM · 6.8 In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to physical escalation of privilege with…
- CVE-2026-56906 HIGH · 7.0 In ep_free van eventpoll.c is er een mogelijke use-after-free vanwege een wedstrijdconditie. Dit kan leiden tot lokale escalatie van privileges zonder dat er extra uitvoerende…
- CVE-2026-55330 CRITICAL · 9.8 In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with…
- CVE-2026-55307 MEDIUM · 4.4 In kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure…
- CVE-2026-106513 NONE MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and…
- CVE-2026-106512 NONE The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors…
- CVE-2026-106511 CRITICAL · 9.8 MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account…
- CVE-2026-106443 HIGH · 8.8 WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS…
- CVE-2026-106442 HIGH · 7.8 Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 incompletely checks the…
- CVE-2026-106441 HIGH · 7.8 Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target…
- CVE-2026-106440 HIGH · 7.8 Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.custom_search_space,…
- CVE-2026-106439 NONE Hydra is een raamwerk voor het elegant configureren van complexe toepassingen. Van 1.3.4 tot 1.3.7 en 1.4.0.dev10 slaat Hydra legacy geïnstantieerde doelbloklijsten en gerelateerde uitvoeringsbeleidscollecties…
- CVE-2026-106427 MEDIUM · 5.4 Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged… Google Apple
- CVE-2026-106426 HIGH · 8.3 Raceconditie in lettertypen in Google Chrome vóór 155.0.8059.39 stond een externe aanvaller toe om mogelijk willekeurige code buiten de sandbox uit te voeren via een… Google
- CVE-2026-106425 MEDIUM · 4.2 Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to… Google
- CVE-2026-106424 MEDIUM · 4.0 Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the… Google