CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-105852 HIGH · 7.5 Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with… Payloadcms
- CVE-2026-105851 HIGH · 8.1 Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation… Payloadcms
- CVE-2026-105850 HIGH · 8.2 Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe… Payloadcms
- CVE-2026-105849 HIGH · 8.3 Payload is een gratis en open source headless contentmanagementsysteem. In versies van 3.0.0 vóór 3.90.0 en canarische versies vóór 4.0.0-canary.34 kunnen gebruikers met gewone leestoegang… Payloadcms
- CVE-2026-105848 CRITICAL · 9.6 Payload is een gratis en open source headless contentmanagementsysteem. In @payloadcms/plugin-stripe versies vóór 3.90.0 en canarische versies vóór 4.0.0-canary.34 kan een geverifieerde gebruiker die de… Payloadcms
- CVE-2026-105847 MEDIUM · 6.5 Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who… Payloadcms
- CVE-2026-105846 MEDIUM · 6.1 Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can… Payloadcms
- CVE-2026-104850 HIGH · 7.5 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and…
- CVE-2026-104070 CRITICAL · 9.8 The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the…
- CVE-2025-71384 MEDIUM · 6.7 Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP…
- CVE-2025-71383 CRITICAL · 9.8 Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username…
- CVE-2026-76105 HIGH · 7.7 Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability. An unauthenticated attacker with local access could potentially exploit…
- CVE-2026-70411 HIGH · 7.1 Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service (TenantService). An unauthenticated…
- CVE-2026-67273 CRITICAL · 9.6 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker…
- CVE-2026-67270 HIGH · 8.2 Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could…
- CVE-2026-63691 MEDIUM · 6.1 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxy . An unauthenticated…
- CVE-2026-63690 MEDIUM · 5.4 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with…
- CVE-2026-63689 MEDIUM · 6.5 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access…
- CVE-2026-61411 HIGH · 7.7 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access…
- CVE-2026-26287 HIGH · 7.1 External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version…
- CVE-2026-105950 LOW · 3.5 A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI…
- CVE-2026-105845 CRITICAL · 9.8 Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user…
- CVE-2026-105844 NONE Payload is een gratis en open source headless contentmanagementsysteem. In versies van 3.0.0 vóór 3.88.0 en canarische versies vóór 4.0.0-canary.27 kan een niet-geverifieerde gebruiker prototype-gevoelige…
- CVE-2026-105806 NONE Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API…
- CVE-2026-105805 NONE Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can…
- CVE-2026-105804 NONE Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use…
- CVE-2026-67269 CRITICAL · 9.9 Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged… Dell
- CVE-2026-63692 CRITICAL · 10.0 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit… Dell
- CVE-2026-63688 CRITICAL · 10.0 Dell Container Storage Modules (CSM), versies voorafgaand aan v1.18.0, bevat een ontbrekende authenticatie voor kritieke functiekwetsbaarheid in de csm-autorisatie-opslag gRPC-server. Een niet-geverifieerde externe aanvaller kan… Dell
- CVE-2026-61421 CRITICAL · 9.8 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access… Dell
- CVE-2026-54472 CRITICAL · 9.8 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could… Dell
- CVE-2026-105922 MEDIUM · 4.3 A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty… Vllm
- CVE-2026-105921 MEDIUM · 6.3 A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year…
- CVE-2026-105801 NONE openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and…
- CVE-2026-105800 LOW · 3.7 i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated…
- CVE-2026-105799 NONE LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch…
- CVE-2026-105798 HIGH · 8.7 SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_documents/upload stores an attacker-controlled group document…
- CVE-2026-105797 HIGH · 8.8 SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in…
- CVE-2026-105796 HIGH · 8.8 Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing…
- CVE-2026-105795 LOW · 3.1 Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI description into a…
- CVE-2026-105794 NONE MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic…
- CVE-2026-105793 CRITICAL · 9.1 Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code…
- CVE-2026-105792 MEDIUM · 6.5 Microsoft UFO is een open-source framework voor intelligente automatisering op verschillende apparaten en platforms. Voorafgaand aan 3.0.9 roept het /api/task_result/{task_name} -eindpunt SessionManager.get_result_by_task () op in…
- CVE-2026-105791 HIGH · 7.5 Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecutor component of ufo/client/mcp/local_servers/cli_mcp_server.py…
- CVE-2026-104069 HIGH · 7.2 HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before…
- CVE-2025-8352 NONE Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to conditions for a Denial-of-Service attack.
- CVE-2026-91140 CRITICAL · 9.6 An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker…
- CVE-2026-87975 MEDIUM · 4.3 An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on…
- CVE-2026-87890 MEDIUM · 5.3 An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups…
- CVE-2026-85523 HIGH · 8.8 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS…