CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-103348 HIGH · 7.2 Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.
- CVE-2026-103337 MEDIUM · 6.5 Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through…
- CVE-2026-103066 HIGH · 8.5 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue…
- CVE-2026-100511 HIGH · 8.8 Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from…
- CVE-2026-100506 HIGH · 7.2 Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1.
- CVE-2026-97309 NONE Ontbrekende autorisatiekwetsbaarheid in Webful Creations RepairBuddy computer-reparatie-shop maakt het mogelijk om ingesloten gevoelige gegevens op te halen. Dit probleem heeft invloed op RepairBuddy: van n.v.t.…
- CVE-2026-97305 NONE Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrect Configured Access Control Security Levels. Dit…
- CVE-2026-97304 MEDIUM · 6.5 Ontbrekende kwetsbaarheid voor autorisatie in tijdschema's van Arraytics maakt het mogelijk om onjuist geconfigureerde toegangscontrolebeveiligingsniveaus te exploiteren. Dit probleem heeft invloed op tijdschema's: van n.v.t.…
- CVE-2026-97303 HIGH · 7.6 Ontbrekende kwetsbaarheid voor autorisatie in Apps Mav Scratch & Win – Giveaways en wedstrijden scratch-win-giveaways-for-website-facebook maakt het mogelijk om onjuist geconfigureerde beveiligingsniveaus voor toegangscontrole te…
- CVE-2026-97283 CRITICAL · 9.8 Deserialisatie van niet-vertrouwde gegevenskwetsbaarheid in Liquid Web /StellarWP Advanced Post Manager advanced-post-manager maakt objectinjectie mogelijk. Dit probleem heeft invloed op Advanced Post Manager: van n.v.t.…
- CVE-2026-97275 MEDIUM · 5.3 Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This…
- CVE-2026-97070 NONE Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a…
- CVE-2026-95166 MEDIUM · 5.4 In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload.
- CVE-2026-95165 MEDIUM · 6.1 Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.
- CVE-2026-88424 CRITICAL · 9.8 FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information…
- CVE-2026-58880 HIGH · 7.0 In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to local escalation of… Google
- CVE-2026-58865 HIGH · 7.5 In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial… Google
- CVE-2026-58859 HIGH · 7.8 In multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escalation of privilege with no… Google
- CVE-2026-58856 LOW · 3.3 In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no… Google
- CVE-2026-58854 HIGH · 7.8 In multiple locations, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution… Google
- CVE-2026-58841 HIGH · 7.8 In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation… Google
- CVE-2026-58835 HIGH · 8.8 In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no… Google
- CVE-2026-58834 MEDIUM · 5.5 In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service… Google
- CVE-2026-58815 HIGH · 7.8 In multiple locations, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege… Google
- CVE-2026-55286 HIGH · 7.8 In stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of… Google
- CVE-2026-55280 HIGH · 8.8 Op meerdere locaties is er mogelijk buiten het bereik schrijven als gevolg van niet-geïnitialiseerde gegevens. Dit kan leiden tot escalatie van privileges op afstand zonder… Google
- CVE-2026-55270 HIGH · 7.8 In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with… Google
- CVE-2026-55269 HIGH · 7.8 In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with… Google
- CVE-2026-55266 HIGH · 7.8 In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion. This could lead to local escalation of privilege with no additional… Google
- CVE-2026-55265 MEDIUM · 6.5 In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This could lead to a remote… Google
- CVE-2026-49937 HIGH · 7.8 In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation… Google
- CVE-2026-49933 HIGH · 7.8 In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to… Google
- CVE-2026-49885 HIGH · 7.8 In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no… Google
- CVE-2026-49880 HIGH · 7.8 In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege… Google
- CVE-2026-49878 HIGH · 7.2 In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution… Google
- CVE-2026-45524 HIGH · 8.8 In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with… Google
- CVE-2026-28667 MEDIUM · 5.5 In multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with… Google
- CVE-2026-28648 HIGH · 7.8 In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution… Google
- CVE-2026-28647 HIGH · 7.8 In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of… Google
- CVE-2026-28641 HIGH · 7.8 In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of… Google
- CVE-2026-28640 HIGH · 7.8 In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no… Google
- CVE-2026-28625 HIGH · 7.8 In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege… Google
- CVE-2026-105712 LOW · 3.6 gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into…
- CVE-2026-105646 MEDIUM · 4.9 Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server…
- CVE-2026-105645 MEDIUM · 4.9 Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making…
- CVE-2026-105644 MEDIUM · 6.8 Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced…
- CVE-2026-105643 HIGH · 7.3 Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting.…
- CVE-2026-105642 HIGH · 8.8 Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling.…
- CVE-2026-105641 CRITICAL · 9.8 Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults that remain…
- CVE-2026-105640 CRITICAL · 9.1 Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where…