CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-104849 NONE Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring…
- CVE-2026-104848 NONE Tinypool is een minimale Node.js worker thread pool implementatie. Voorafgaand aan 2.1.1 construeert Tinypool ThreadPool.options van een normaal optieobject en leest de execArgv- en env-werknemeropties…
- CVE-2026-96613 MEDIUM · 6.5 De Meari IoT Cloud Platform OpenAPI Service is kwetsbaar voor een autorisatiefout waarmee geverifieerde gebruikers toegang hebben tot de volledige apparaatschaduw van elk apparaat door…
- CVE-2026-94544 MEDIUM · 4.2 Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without… Vercel
- CVE-2026-94543 MEDIUM · 5.3 Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated… Vercel
- CVE-2026-94486 MEDIUM · 5.4 Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint… Vercel
- CVE-2026-94485 MEDIUM · 5.3 Next.js is een React-framework voor het bouwen van full-stack webapplicaties. Van 16.0.0 tot 16.3.8 legt de `next dev` ontwikkelingsserver een Model Context Protocol-eindpunt bloot zonder… Vercel
- CVE-2026-94484 MEDIUM · 4.8 Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated… Vercel
- CVE-2026-94483 MEDIUM · 6.5 Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL… Vercel
- CVE-2026-67989 HIGH · 7.5 crmne/ruby_llm bij commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 bevat een polynomial-time reguliere expressie denial-of-service voorwaarde in Mistral model capability matching op Ruby 3.1.x
- CVE-2026-51922 CRITICAL · 9.8 agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.
- CVE-2026-51918 CRITICAL · 9.8 FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().
- CVE-2026-51917 HIGH · 7.3 FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code.
- CVE-2026-51916 HIGH · 7.5 TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/{knowledge_id} deletes the selected knowledge object without…
- CVE-2026-51915 CRITICAL · 9.8 TransformerOptimus SuperAGI v0.0.14 is kwetsbaar voor onjuiste toegangscontrole in de gereedschapscontroller. In getroffen bronmomentopnamen accepteren get_tool en update_tool in superagi/controllers/tool.py een door de beller geleverde…
- CVE-2026-51914 HIGH · 8.8 TransformerOptimus SuperAGI v0.0.14 is kwetsbaar voor onjuiste toegangscontrole in de agent template controller. In getroffen bronmomentopnamen, save_agent_as_template en publish_template in superagi/controllers/agent_template.py accepteer door de beller…
- CVE-2026-51911 CRITICAL · 9.8 vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.
- CVE-2026-51907 HIGH · 8.1 In TaskingAI v0.3.0 in de QR Code Generator plugin save_base64_image-functie, stelt een kwetsbaarheid voor het doorlopen van het pad aanvallers in staat om afbeeldingsbestanden naar…
- CVE-2026-51906 CRITICAL · 9.1 In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations…
- CVE-2026-51904 CRITICAL · 9.8 SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept…
- CVE-2026-51901 HIGH · 8.1 SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing…
- CVE-2026-51899 MEDIUM · 4.3 In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow authenticated users from one organization to create, schedule, edit, stop, and delete…
- CVE-2026-51898 CRITICAL · 9.8 sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.
- CVE-2026-104914 NONE MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes (e.g., via…
- CVE-2026-104912 NONE MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system…
- CVE-2026-104910 NONE MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the…
- CVE-2026-104908 NONE MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging…
- CVE-2026-104907 NONE MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders…
- CVE-2026-104906 NONE MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was…
- CVE-2026-104901 NONE MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote)…
- CVE-2026-104900 NONE MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated…
- CVE-2026-104847 NONE ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice…
- CVE-2026-104846 CRITICAL · 9.8 Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass…
- CVE-2026-104845 HIGH · 7.5 Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as…
- CVE-2026-104844 MEDIUM · 5.9 PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a…
- CVE-2026-104843 NONE uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel…
- CVE-2026-103648 CRITICAL · 9.1 Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured…
- CVE-2026-103631 HIGH · 8.8 Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… Google
- CVE-2026-103630 CRITICAL · 9.6 Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted… Google
- CVE-2026-103629 MEDIUM · 4.3 Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security… Google
- CVE-2026-103628 CRITICAL · 9.6 Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a… Google
- CVE-2026-103627 MEDIUM · 6.5 Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security… Google
- CVE-2026-103626 CRITICAL · 9.6 Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code… Google Microsoft
- CVE-2026-103625 HIGH · 8.8 Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… Google
- CVE-2026-103624 HIGH · 8.3 Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the renderer process… Google Microsoft
- CVE-2026-103623 HIGH · 8.8 Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… Google
- CVE-2026-103622 HIGH · 8.8 Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… Google
- CVE-2026-103621 MEDIUM · 4.3 Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security… Google
- CVE-2026-101104 HIGH · 7.7 The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do…
- CVE-2026-90970 CRITICAL · 9.9 GitLab heeft een kwetsbaarheid in de GitLab AI Gateway-component verholpen die van invloed was op alle versies van de AI Gateway van 18.1.6 vóór 19.2.4,…