CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-101919 HIGH · 8.8 A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without proper…
- CVE-2025-15643 HIGH · 7.1 Onjuiste neutralisatie van invoer tijdens het genereren van webpagina's ('Cross-site Scripting') kwetsbaarheid in Jose Fernandez Adsmonetizer adsensei-b30 maakt Reflected XSS mogelijk. Dit probleem heeft invloed…
- CVE-2026-86671 NONE In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which calls `new URL(url).openConnection()` with…
- CVE-2026-78412 MEDIUM · 4.9 Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the…
- CVE-2026-12171 HIGH · 7.8 auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and honors security-sensitive…
- CVE-2026-105383 HIGH · 7.3 A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file php/controller.php. Such manipulation of the argument…
- CVE-2026-105382 HIGH · 7.3 A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function update_subaccount of the file php/controller.php of the component Account Administration.…
- CVE-2026-104970 HIGH · 8.1 Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-229 uses InstanceAdmin.objects.first() for the first-admin check and performs account creation…
- CVE-2026-104969 MEDIUM · 6.5 Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong…
- CVE-2026-104968 NONE Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who…
- CVE-2026-104967 MEDIUM · 5.4 Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them…
- CVE-2026-104966 NONE Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and…
- CVE-2026-104965 MEDIUM · 5.4 Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong…
- CVE-2026-104964 MEDIUM · 6.8 Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL…
- CVE-2026-104963 MEDIUM · 4.3 Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/{slug}/modules/ through WorkspaceModulesEndpoint return records from every project in…
- CVE-2026-104962 MEDIUM · 6.5 Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ returns the complete project-member roster, including each member's email address, first and last…
- CVE-2026-104961 MEDIUM · 5.4 Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require is_active=True when checking whether a user is a workspace owner. A…
- CVE-2026-104960 MEDIUM · 6.5 Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint for project-bound FileAsset objects without enforcing access to…
- CVE-2026-104956 MEDIUM · 5.3 Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts group_by and sub_group_by query parameters and passes them without…
- CVE-2026-104955 MEDIUM · 5.4 Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update…
- CVE-2026-104894 MEDIUM · 4.3 Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong…
- CVE-2026-104893 MEDIUM · 5.4 Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/{token_id}/ allows the…
- CVE-2026-102779 NONE Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task…
- CVE-2026-102777 MEDIUM · 6.5 Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of… Svenbluege
- CVE-2026-102282 HIGH · 7.1 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a…
- CVE-2026-88397 MEDIUM · 6.5 ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.
- CVE-2026-88396 HIGH · 7.2 ApiAdmin v5.0 en eerder is kwetsbaar voor Directory Traversal. De admin file-upload endpoint POST /admin/Index/upload in ApiAdmin neemt de extensie van het geüploade bestand letterlijk…
- CVE-2026-88395 CRITICAL · 9.8 GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.
- CVE-2026-88393 CRITICAL · 9.8 WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the…
- CVE-2026-37719 CRITICAL · 9.8 An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.
- CVE-2026-105397 MEDIUM · 5.4 LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation…
- CVE-2026-105329 MEDIUM · 6.3 A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms/src/Filament/Pages/ThemeManager.php of the component PluginManager. Executing a manipulation…
- CVE-2026-104892 NONE Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user…
- CVE-2026-104891 HIGH · 7.5 mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied…
- CVE-2026-104890 HIGH · 7.2 Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath…
- CVE-2026-102780 CRITICAL · 9.8 Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and… Techfry
- CVE-2026-102778 MEDIUM · 6.1 Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a… Svenbluege
- CVE-2026-102776 MEDIUM · 4.3 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks which the… Svenbluege
- CVE-2026-102775 HIGH · 7.5 Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download… Phoca
- CVE-2026-102428 CRITICAL · 9.8 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not… Ordasoft
- CVE-2026-102426 MEDIUM · 6.1 Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum… Ollyo
- CVE-2026-89039 MEDIUM · 6.5 A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of…
- CVE-2026-88394 HIGH · 7.5 WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the…
- CVE-2026-88392 HIGH · 7.5 Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code.
- CVE-2026-88391 CRITICAL · 9.8 Northstar (dromara/northstar, quantitative trading platform)
- CVE-2026-79820 CRITICAL · 9.0 A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.
- CVE-2026-105421 MEDIUM · 5.3 Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit) for…
- CVE-2026-92931 HIGH · 8.8 CWE-918: Server-Side Request Forgery in de Progress @progress/sitefinity-nextjs-sdk npm pakketversies 15.1.8326 tot en met 15.4.8637 kan een externe aanvaller toestaan om server-side verzoeken te doen…
- CVE-2026-77805 HIGH · 7.9 In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is…
- CVE-2026-77804 MEDIUM · 6.6 In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use (TOCTOU) race condition exists in the installation of the HTTPS interception…