CVE-database
126.582 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-56661 HIGH · 7.5 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update…
- CVE-2026-56660 CRITICAL · 9.1 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update…
- CVE-2026-55252 NONE OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the restrictions on…
- CVE-2026-55251 MEDIUM · 6.5 NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs…
- CVE-2026-54049 HIGH · 8.7 Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores…
- CVE-2026-53964 HIGH · 7.2 Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0,…
- CVE-2026-53953 CRITICAL · 9.1 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset…
- CVE-2026-14984 NONE Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, hijack, or modify session traffic…
- CVE-2026-14983 NONE Ontbrekende authenticatie in de webinterface in Teledyne FLIR Aware2-versies via 6.9.0.2 stelt niet-geverifieerde aanvallers op afstand in staat om denial of service te bereiken tegen…
- CVE-2026-103484 HIGH · 8.8 IVFFlat-index ingebouwd pgvector vóór 0.8.7 stelt een databasegebruiker in staat om gegevens buiten de grenzen te schrijven, wat kan leiden tot willekeurige code-uitvoering.
- CVE-2026-102671 MEDIUM · 5.3 The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default.
- CVE-2026-102670 MEDIUM · 4.3 Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it.
- CVE-2026-102669 MEDIUM · 5.3 Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages.
- CVE-2026-102668 MEDIUM · 5.3 De Joyland AI-app accepteert alle TLS-certificaten van elke server zonder validatie.
- CVE-2026-102667 HIGH · 8.3 Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access…
- CVE-2026-102666 MEDIUM · 6.5 The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push…
- CVE-2026-102628 CRITICAL · 9.3 The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a…
- CVE-2026-100251 MEDIUM · 6.5 Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance…
- CVE-2026-8618 NONE A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before…
- CVE-2026-84682 NONE A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to…
- CVE-2026-63724 NONE Reden van afwijzing: deze CVE-ID is afgewezen of ingetrokken door de CVE-nummeringsinstantie.
- CVE-2026-63721 NONE Reden van afwijzing: deze CVE-ID is afgewezen of ingetrokken door de CVE-nummeringsinstantie.
- CVE-2026-55232 HIGH · 7.6 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF…
- CVE-2026-55231 HIGH · 7.2 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed…
- CVE-2026-55230 HIGH · 8.7 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML…
- CVE-2026-55083 CRITICAL · 9.1 DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to…
- CVE-2026-27872 NONE - Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force). This issue affects Easy IO FG: before 2.0b52.
- CVE-2026-15911 HIGH · 7.4 Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.
- CVE-2026-104059 HIGH · 8.1 Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending…
- CVE-2026-104058 MEDIUM · 5.3 Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group,…
- CVE-2026-104057 HIGH · 7.5 Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers and allConnections) in its WebSocket handler, where Wshandler and HandleWebsocketMessages…
- CVE-2026-104056 CRITICAL · 9.8 Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response…
- CVE-2026-9032 NONE Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after…
- CVE-2026-97662 HIGH · 8.2 An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate…
- CVE-2026-78578 NONE Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can…
- CVE-2026-78577 NONE Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker…
- CVE-2026-73976 NONE djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through…
- CVE-2026-68496 HIGH · 7.5 De Smile-parser in FasterXML jackson-dataformats-binary roept nooit StreamReadConstraints.validateNameLength() aan bij het decoderen van JSON-objecteigenschapsnamen, dus de maxNameLength-limiet wordt niet afgedwongen voor dit formaat. SmileParser._handleLongFieldName() breidt…
- CVE-2026-68495 HIGH · 7.5 The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format.…
- CVE-2026-56098 MEDIUM · 4.3 A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_authorize filter. While…
- CVE-2026-56097 MEDIUM · 6.5 A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input…
- CVE-2026-12545 MEDIUM · 6.7 A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due…
- CVE-2026-12542 MEDIUM · 5.3 A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The…
- CVE-2026-104018 HIGH · 8.8 An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under certain shell…
- CVE-2026-103923 NONE KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for…
- CVE-2026-103922 CRITICAL · 9.3 Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard…
- CVE-2026-103884 MEDIUM · 6.5 A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate…
- CVE-2026-102369 NONE Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker…
- CVE-2026-102294 NONE TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system…
- CVE-2023-54404 HIGH · 7.5 Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large…