CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-105639 CRITICAL · 9.8 Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band…
- CVE-2026-105638 CRITICAL · 9.1 Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy.…
- CVE-2026-105637 CRITICAL · 9.6 Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constrain the query…
- CVE-2026-105636 CRITICAL · 9.9 Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_redirects=False and does not validate redirect…
- CVE-2026-105635 HIGH · 7.4 Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including…
- CVE-2026-105634 HIGH · 8.1 Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including a user with the lowest GUEST role,…
- CVE-2026-105387 HIGH · 7.3 A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file cover.php of the component Patient…
- CVE-2026-105386 HIGH · 7.3 A vulnerability was identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this issue is the function get of the file print.php. The manipulation of…
- CVE-2026-105326 LOW · 2.5 An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri.…
- CVE-2026-104714 HIGH · 8.8 Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the… Apache
- CVE-2026-104713 MEDIUM · 6.5 Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on… Apache
- CVE-2026-104712 HIGH · 7.5 Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through… Apache
- CVE-2026-104711 CRITICAL · 9.8 Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use… Apache
- CVE-2026-103352 CRITICAL · 9.3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue…
- CVE-2026-103349 HIGH · 7.2 Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce:…
- CVE-2026-103334 HIGH · 7.5 Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects…
- CVE-2026-103086 MEDIUM · 6.5 Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74.
- CVE-2026-103085 MEDIUM · 6.5 Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20.
- CVE-2026-102383 MEDIUM · 6.5 Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14.
- CVE-2026-100515 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews…
- CVE-2026-100509 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Stored XSS.This issue affects RepairBuddy: from n/a through…
- CVE-2026-93323 NONE The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized…
- CVE-2026-93322 NONE Een kwaadwillende frontend kan een LLB-definitie indienen die buildkitd veroorzaakt om in paniek te raken en te beëindigen, waardoor alle builds die op die daemon…
- CVE-2026-93320 NONE BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful…
- CVE-2026-93319 NONE A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit…
- CVE-2026-93318 NONE Een kwaadaardige afbeelding kan DiffID's van een andere afbeelding adverteren terwijl deze verschillende laaginhoud bevat. In de betreffende versies kon BuildKit de geadverteerde DiffID's gebruiken…
- CVE-2026-93317 NONE Een niet-geverifieerde aanvaller die een register of OCI-layout-blobbron beheert, kan blob-inhoud leveren die niet overeenkomt met de geclaimde samenvatting. De resulterende momentopname kan onder die…
- CVE-2026-93316 NONE Als BuildKit-daemon wordt gestart met --cdi-uitgeschakeld, kan dit leiden tot daemon-paniek wanneer builds CDI-apparaten proberen te gebruiken. Dit kan kwaadwillig of per ongeluk gebeuren.
- CVE-2026-78413 MEDIUM · 5.5 Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions.…
- CVE-2026-78411 MEDIUM · 6.5 Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server…
- CVE-2026-42700 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This issue affects Image Slider Widget:…
- CVE-2026-105633 HIGH · 7.1 Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the…
- CVE-2026-105632 NONE Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that…
- CVE-2026-105631 HIGH · 7.5 Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's…
- CVE-2026-105630 HIGH · 8.7 Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a…
- CVE-2026-105629 HIGH · 7.1 Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key lookup without workspace, project, or estimate…
- CVE-2026-105628 HIGH · 7.6 Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through a server-side HTTP…
- CVE-2026-105385 HIGH · 7.3 A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this vulnerability is an unknown functionality of the file transaction_details.php. Executing a manipulation…
- CVE-2026-105384 HIGH · 7.3 A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patient_info.php. Performing a manipulation of the argument…
- CVE-2026-104979 HIGH · 8.7 Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects.create(...) without calling validate_html_content from nh3. Any authenticated…
- CVE-2026-104978 HIGH · 8.2 Plane is een open-source tool voor projectmanagement. Vóór versie 1.4.0 was het eindpunt voor de projectuitnodigingslijst van Plane toegankelijk voor elke geauthenticeerde gebruiker die de…
- CVE-2026-104977 HIGH · 7.7 Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2,…
- CVE-2026-104976 NONE Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve…
- CVE-2026-104975 HIGH · 7.1 Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and…
- CVE-2026-104974 HIGH · 8.1 Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with…
- CVE-2026-104973 HIGH · 7.6 Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in…
- CVE-2026-104971 HIGH · 8.5 Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset…
- CVE-2026-104905 HIGH · 8.1 FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an…
- CVE-2026-102576 MEDIUM · 4.2 A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS).…
- CVE-2026-102295 MEDIUM · 5.4 A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code…