CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-105485 MEDIUM · 6.8 Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of…
- CVE-2026-104945 NONE TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number…
- CVE-2026-104944 NONE TP-Link Tapo C500 v2.0 bevat een out-of-bounds functie-aanwijzer verzending in zijn TDP (TP-Link Device Protocol) daemon. Een enkel niet-geverifieerd UDP-datagram kan een ongeldige indirecte oproep…
- CVE-2026-104073 HIGH · 7.6 NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal…
- CVE-2026-103778 MEDIUM · 6.2 Dell Command | Configure (DCC), versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially…
- CVE-2026-103620 NONE A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through…
- CVE-2026-102322 CRITICAL · 9.6 Onjuiste autorisatie in SiteIsolation in Google Chrome vóór 155.0.8059.39 stond een externe aanvaller toe om willekeurige code uit te voeren via een vervaardigde HTML-pagina. (Ernst… Google
- CVE-2026-0198 MEDIUM · 4.4 In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with System…
- CVE-2026-88252 MEDIUM · 4.7 A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system… Fedoraproject Redhat
- CVE-2026-66666 NONE Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from…
- CVE-2026-106117 HIGH · 7.5 ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded…
- CVE-2026-106116 MEDIUM · 5.3 ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When… Sixlabors
- CVE-2026-106115 HIGH · 7.5 ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can… Sixlabors
- CVE-2026-106114 MEDIUM · 5.3 ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that… Sixlabors
- CVE-2026-106113 HIGH · 7.5 ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image and applying HistogramEqualization can produce a non-finite… Sixlabors
- CVE-2026-106112 HIGH · 7.5 ImageSharp is een 2D grafische bibliotheek. Van 4.0.0 tot 4.1.2 accepteert ICC LUT16-conversie meer dan vier uitvoerkanalen, hoewel ClutCalculator.Calculate en LutEntryCalculator.CalculateLut tussentijdse en uitvoerwaarden opslaan… Sixlabors
- CVE-2026-106111 MEDIUM · 5.9 ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR… Sixlabors
- CVE-2026-106110 HIGH · 7.5 ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images.… Sixlabors
- CVE-2026-106109 NONE Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting…
- CVE-2026-106107 NONE Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into…
- CVE-2026-106106 NONE Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from…
- CVE-2026-106105 NONE Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a…
- CVE-2026-106104 NONE Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js,…
- CVE-2026-106103 HIGH · 7.1 Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values…
- CVE-2026-101207 HIGH · 8.8 Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS…
- CVE-2025-45871 HIGH · 8.1 LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via…
- CVE-2026-95153 MEDIUM · 4.9 An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints
- CVE-2026-95140 HIGH · 7.5 kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into…
- CVE-2026-106219 MEDIUM · 6.5 In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server Jetbrains
- CVE-2026-106218 HIGH · 8.8 In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible Jetbrains
- CVE-2026-106102 CRITICAL · 10.0 Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values…
- CVE-2026-106101 LOW · 3.1 Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed…
- CVE-2026-106100 HIGH · 7.1 Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who… Payloadcms
- CVE-2026-105957 MEDIUM · 6.3 A vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/admin/view_product.php. Performing a manipulation of…
- CVE-2026-105868 HIGH · 7.1 Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept… Payloadcms
- CVE-2026-105867 MEDIUM · 6.5 Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can… Payloadcms
- CVE-2026-105866 HIGH · 7.5 Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows… Payloadcms
- CVE-2026-105865 HIGH · 8.1 Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can… Payloadcms
- CVE-2026-105864 MEDIUM · 4.3 Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited… Payloadcms
- CVE-2026-105863 CRITICAL · 9.4 Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a… Payloadcms
- CVE-2026-105862 HIGH · 8.7 Payload is een gratis en open source headless contentmanagementsysteem. In versies vóór 3.90.0 en canarische versies vóór 4.0.0-canary.34 kan een verzameling die downloadbare SVG-uploads toestaat,… Payloadcms
- CVE-2026-105861 HIGH · 8.2 Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward… Payloadcms
- CVE-2026-105860 HIGH · 7.1 Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array… Payloadcms
- CVE-2026-105859 CRITICAL · 9.8 Payload is een gratis en open source headless contentmanagementsysteem. In versies vóór 3.90.0 en canarische versies vóór 4.0.0-canary.34 kan een aanvaller een verzoek indienen bij… Payloadcms
- CVE-2026-105858 HIGH · 8.1 Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the… Payloadcms
- CVE-2026-105857 CRITICAL · 10.0 Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft… Payloadcms
- CVE-2026-105856 HIGH · 8.3 Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access… Payloadcms
- CVE-2026-105855 HIGH · 7.1 Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce… Payloadcms
- CVE-2026-105854 HIGH · 7.5 Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart… Payloadcms
- CVE-2026-105853 MEDIUM · 6.5 Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses… Payloadcms