CVE-database
126.586 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-96659 CRITICAL · 9.1 A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to…
- CVE-2026-96658 CRITICAL · 9.9 A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the…
- CVE-2026-93546 HIGH · 8.8 Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt… Apache
- CVE-2026-79768 MEDIUM · 5.3 Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir) This issue… Apache
- CVE-2026-77387 MEDIUM · 4.0 geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior when an…
- CVE-2026-73975 NONE djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying (DELETE/INSERT)…
- CVE-2026-73637 HIGH · 7.3 Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication… Apache
- CVE-2026-73636 HIGH · 8.1 Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured… Apache
- CVE-2026-67172 LOW · 3.7 HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to… Hcltech
- CVE-2026-67171 MEDIUM · 5.3 HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable… Hcltech
- CVE-2026-63718 HIGH · 7.5 Inconsistente interpretatie van HTTP-verzoeken ('HTTP Request/Response Smuggling'): kwetsbaarheid voor het smokkelen van HTTP-reacties in Apache HTTP Server via mod_proxy_uwsgi en een speciaal geconstrueerde uwsgi-reactie met… Apache
- CVE-2026-63686 HIGH · 7.5 A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause… Apache
- CVE-2026-63292 HIGH · 7.5 Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial… Apache
- CVE-2026-63045 HIGH · 7.5 Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy… Apache
- CVE-2026-59797 CRITICAL · 9.8 Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. Apache
- CVE-2026-59685 HIGH · 7.5 Out-of-bounds Schrijf kwetsbaarheid in Apache HTTP Server op Windows tijdens het verwerken van paden met 8.3 namen die kunnen groeien wanneer ze worden uitgebreid. Dit… Apache
- CVE-2026-58415 MEDIUM · 5.3 Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client… Apache
- CVE-2026-57941 CRITICAL · 9.8 Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. Apache
- CVE-2026-56449 HIGH · 7.5 Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. Apache
- CVE-2026-56154 CRITICAL · 9.8 Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. Apache
- CVE-2026-56153 HIGH · 7.5 Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. Apache
- CVE-2026-48005 HIGH · 7.5 Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a… Apache
- CVE-2026-21833 LOW · 3.7 HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site…
- CVE-2026-14316 HIGH · 8.1 Het foutpad met ingetrokken sleutel bouwt een voor mensen leesbare faalreden op met behulp van sprintf() in een heapbuffer. De toegewezen buffer is te klein…
- CVE-2026-13043 NONE A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the…
- CVE-2026-12544 HIGH · 7.7 A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct… Redhat Theforeman
- CVE-2026-12541 HIGH · 8.2 A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied… Redhat Theforeman
- CVE-2026-12540 HIGH · 8.2 A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system… Redhat Theforeman
- CVE-2026-12423 HIGH · 7.5 A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw… Redhat Theforeman
- CVE-2026-12405 HIGH · 8.8 A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user…
- CVE-2026-103921 HIGH · 7.4 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js…
- CVE-2026-101890 MEDIUM · 5.4 De Prime Mover-plug-in voor WordPress vóór 2.2.1 bevat een opgeslagen kwetsbaarheid voor cross-site scripting waarmee aanvallers willekeurig JavaScript kunnen uitvoeren door een ongecodeerde site_title-waarde in…
- CVE-2026-101889 MEDIUM · 6.5 The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted…
- CVE-2026-101888 HIGH · 7.2 The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the…
- CVE-2025-31980 MEDIUM · 4.3 HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application,… Hcltech
- CVE-2026-9864 MEDIUM · 4.8 Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations…
- CVE-2026-94620 NONE Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, `gh teacher download` clones each…
- CVE-2026-79896 HIGH · 7.5 Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed…
- CVE-2026-47360 HIGH · 7.5 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie… Apache
- CVE-2026-46729 HIGH · 7.5 NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. Apache
- CVE-2026-42528 MEDIUM · 4.3 A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child… Apache
- CVE-2026-42356 LOW · 3.7 Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI… Apache
- CVE-2026-18734 NONE Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this…
- CVE-2026-17053 MEDIUM · 4.4 De API van het SMBus-stuurprogramma stelde smbus_smbalert_remove_cb() en smbus_host_notify_remove_cb() bloot als Zephyr-syscalls. Hun verificateurs in drivers/smbus/smbus_handlers.c valideerden alleen het dev-argument met K_SYSCALL_obj(dev, K_OBJ_DRIVER_SMBUS) en stuurden…
- CVE-2026-12627 CRITICAL · 9.8 Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may…
- CVE-2026-103690 MEDIUM · 6.3 A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the…
- CVE-2026-103505 MEDIUM · 6.5 Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with…
- CVE-2026-101322 NONE In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing requests…
- CVE-2026-97297 HIGH · 7.6 Subscriber Broken Access Control in Gratisfaction
- CVE-2026-97284 HIGH · 8.8 Contributor PHP Object Injection in Icegram