CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-16000 NONE Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who…
- CVE-2026-15999 NONE Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an…
- CVE-2026-13413 MEDIUM · 5.3 The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing…
- CVE-2026-102565 HIGH · 7.2 The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_service_qty' parameter in all versions up to, and including, 1.8.28…
- CVE-2026-97318 MEDIUM · 6.1 The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting…
- CVE-2026-97317 MEDIUM · 5.3 The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public…
- CVE-2026-94298 MEDIUM · 6.2 The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in…
- CVE-2026-92820 HIGH · 8.1 The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the…
- CVE-2026-92174 HIGH · 7.5 The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter…
- CVE-2026-91828 HIGH · 7.5 The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that…
- CVE-2026-91023 LOW · 3.1 The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing…
- CVE-2026-91022 MEDIUM · 6.8 The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with…
- CVE-2026-90988 MEDIUM · 5.3 The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to…
- CVE-2026-90438 HIGH · 7.2 The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE)…
- CVE-2026-85016 MEDIUM · 6.8 The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared…
- CVE-2026-85004 MEDIUM · 4.3 The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated…
- CVE-2026-84925 MEDIUM · 6.1 The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions…
- CVE-2026-81740 MEDIUM · 5.3 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has…
- CVE-2026-78471 MEDIUM · 5.4 The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.1.15.1 due to…
- CVE-2026-15897 HIGH · 8.8 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316.…
- CVE-2026-15896 CRITICAL · 9.1 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316…
- CVE-2026-13718 MEDIUM · 6.8 The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager…
- CVE-2026-19660 CRITICAL · 9.8 The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to the…
- CVE-2026-10026 HIGH · 7.2 The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient…
- CVE-2026-93367 HIGH · 7.2 The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22…
- CVE-2026-14378 CRITICAL · 9.8 The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This…
- CVE-2026-104123 HIGH · 7.3 A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity. The manipulation…
- CVE-2026-104120 HIGH · 7.3 A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetch_url of the file mcp_server_fetch/server.py of the…
- CVE-2026-21140 NONE Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.
- CVE-2026-104480 NONE Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of…
- CVE-2026-104054 MEDIUM · 6.3 A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC…
- CVE-2026-104053 MEDIUM · 6.3 A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file admin_reservefilter.php. Such manipulation of…
- CVE-2026-104052 MEDIUM · 6.3 A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown function of the file admin_reject_completed.php. This manipulation of…
- CVE-2026-103098 HIGH · 7.5 Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key…
- CVE-2026-103097 HIGH · 7.5 An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the…
- CVE-2026-103096 HIGH · 7.5 API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client…
- CVE-2026-86345 CRITICAL · 9.0 Er werd een fout gevonden in 389-ds-base. De server verwijdert geen bytes in platte tekst die al gebufferd zijn van een clientverbinding bij het onderhandelen…
- CVE-2026-103766 HIGH · 7.2 ClipBucket v5 tot en met 5.5.3-#197 bevat een SQL-injectiekwetsbaarheid waarmee geverifieerde gebruikers met toestemming voor ad_manager_access SQL kunnen injecteren via de verwijderingsparameter in admin_area/ads_manager.php. Aanvallers…
- CVE-2026-103765 CRITICAL · 9.4 Mooncake via 0.3.13.post1 bevat een ontbrekende authenticatiekwetsbaarheid in de HTTP-metadataserver/metadatahandler waarmee niet-geverifieerde aanvallers de metadatasleutels van de overdrachtsengine kunnen lezen, overschrijven en verwijderen. Aanvallers kunnen…
- CVE-2026-103764 CRITICAL · 9.8 Mooncake-overdrachtsengine vóór 0.3.13 bevat een niet-vertrouwde pointer-dereferentie in ServerSession:: readHeader waarmee niet-geverifieerde aanvallers willekeurig procesgeheugen kunnen lezen en schrijven via de TCP-transportgegevenspoort. Aanvallers kunnen een…
- CVE-2026-102490 CRITICAL · 9.5 Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be… Zammad Gmbh
- CVE-2026-102489 CRITICAL · 9.5 Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with… Zammad Gmbh
- CVE-2026-103761 HIGH · 7.5 Mooncake transfer engine via 0.3.13.post1 bevat een kwetsbaarheid voor geheugenuitputting in TransferMetadata:: receivePeerNotify waarmee niet-geverifieerde aanvallers onbeperkt procesgeheugen kunnen laten groeien. Aanvallers kunnen herhaaldelijk waarschuwingsframes…
- CVE-2026-103760 MEDIUM · 5.9 Mooncake transfer engine via 0.3.13.post1 bevat een denial of service-kwetsbaarheid waarmee niet-geverifieerde externe aanvallers de handshake-daemon kunnen blokkeren door nooit antwoorden te lezen. Aanvallers kunnen…
- CVE-2025-71427 MEDIUM · 6.8 Office-PowerPoint-MCP-Server via 2.0.7 bevat een kwetsbaarheid voor het doorlopen van paden waarmee MCP-bellers bestanden buiten de werkmap kunnen schrijven en lezen door absolute paden of…
- CVE-2026-86344 HIGH · 7.5 Er werd een fout gevonden in 389-ds-base. Een niet-geverifieerde externe aanvaller kan een volledige LDAP-bewerking verzenden, gevolgd door de eerste bytes van een onvolledig LDAPM-bericht…
- CVE-2026-71454 NONE Onjuiste neutralisatie van invoer tijdens het genereren van webpagina's ('cross-site scripting') kwetsbaarheid in CWE-79 - Cross-site Scripting CAPEC-63 maakt Cross-Site Scripting (XSS) mogelijk. Dit probleem…
- CVE-2026-71453 NONE - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. Dit probleem is van invloed op EASYIO…
- CVE-2026-71452 NONE - OS Command Injection-kwetsbaarheid in Johnson Controls EasyIO FS32 maakt OS Command Injection mogelijk. Dit probleem is van invloed op EASYIO FS32: vóór 3.0b63.
- CVE-2026-71449 NONE : Gebruik van hardgecodeerde cryptografische sleutelkwetsbaarheid in Johnson Controls EasyIO FS32 maakt het mogelijk : Ingesloten gevoelige gegevens op te halen. Dit probleem is van…