CVE-database
126.823 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-97281 MEDIUM · 6.3 Subscriber Broken Access Control in WP Project Manager
- CVE-2026-97280 MEDIUM · 6.5 Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0.
- CVE-2026-97277 HIGH · 7.6 Subscriber Broken Access Control in Social Boost
- CVE-2026-97273 HIGH · 7.1 Niet-geverifieerde Cross Site Scripting (XSS) in Premmerce Wishlist voor WooCommerce
- CVE-2026-97269 MEDIUM · 6.5 Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels
- CVE-2026-97268 HIGH · 7.1 Niet-geverifieerde Cross Site Scripting (XSS) in Premmerce Wishlist voor WooCommerce
- CVE-2026-97260 HIGH · 7.1 Niet-geverifieerde Cross Site Scripting (XSS) in MaxGalleria
- CVE-2026-97258 MEDIUM · 6.5 Subscriber Broken Access Control in Aruba Migration Tool
- CVE-2026-97251 MEDIUM · 6.5 Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation
- CVE-2026-95588 HIGH · 8.6 Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter
- CVE-2026-95137 NONE Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not…
- CVE-2026-94390 HIGH · 7.2 Editor PHP Object Injection in Hide Shipping Method For WooCommerce
- CVE-2026-79900 MEDIUM · 6.5 boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name…
- CVE-2026-79899 HIGH · 7.9 Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local…
- CVE-2026-79898 CRITICAL · 9.1 Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP…
- CVE-2026-67106 MEDIUM · 5.3 HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker… Hcltech
- CVE-2026-67105 HIGH · 7.4 HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic… Hcltech
- CVE-2026-67104 MEDIUM · 5.3 HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the… Hcltech
- CVE-2026-62073 HIGH · 7.5 Unauthenticated Broken Access Control in WP Full Stripe Free
- CVE-2026-62071 CRITICAL · 9.3 Unauthenticated SQL Injection in WordPress File Upload
- CVE-2026-56599 LOW · 2.2 HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as… Hcltech
- CVE-2026-56589 HIGH · 7.2 HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within… Hcltech
- CVE-2026-103752 CRITICAL · 9.8 Unauthenticated Privilege Escalation in Authorizer
- CVE-2026-103687 HIGH · 7.3 A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component…
- CVE-2026-103347 MEDIUM · 5.3 Unauthenticated Bypass Vulnerability in hCaptcha for WP
- CVE-2026-103068 HIGH · 8.8 Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools
- CVE-2026-103004 MEDIUM · 5.3 Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With… Vercel
- CVE-2026-102378 HIGH · 7.1 Niet-geauthenticeerde Cross-Site Scripting (XSS) in Parallax Section-blokken
- CVE-2026-100517 HIGH · 7.5 Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce
- CVE-2026-100514 HIGH · 7.5 Unauthenticated Insecure Direct Object References (IDOR) in REST API Log
- CVE-2024-58388 NONE Sharp (en Toshiba Tec omgedoopt) multifunctionele printers bevatten een niet-geverifieerde kwetsbaarheid voor het opnemen van lokale bestanden waarmee externe aanvallers willekeurige bestanden kunnen lezen door…
- CVE-2026-79901 CRITICAL · 9.9 In implementaties met BoKS keytab-beheer genereren de betreffende versies van boks_keytabmd Active Directory-serviceaccountwachtwoorden uit een voorspelbare pseudo-willekeurige reeks met de huidige Unix-tijdstempel. Een aanvaller die…
- CVE-2026-66253 LOW · 3.1 iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access to…
- CVE-2026-66249 LOW · 3.1 iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized…
- CVE-2026-66248 LOW · 3.1 iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure…
- CVE-2026-66247 MEDIUM · 4.3 iControl wordt beïnvloed door een onveilig CORS-beleid (Cross-Origin Resource Sharing), waardoor een kwaadaardige website cross-origin-verzoeken kan uitvoeren met inbegrepen inloggegevens, waardoor een aanvaller gevoelige gegevens…
- CVE-2026-66246 HIGH · 8.8 iControl wordt beïnvloed door een Broken Access Control-kwetsbaarheid, waardoor een aanvaller misbruik kan maken van ontbrekende authenticatiecontroles of onveilige directe objectverwijzingen (IDOR), waardoor privilege-escalatie en…
- CVE-2026-103686 LOW · 3.5 A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation.…
- CVE-2026-102505 MEDIUM · 6.3 Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with… Tonycoz
- CVE-2026-102504 HIGH · 7.5 Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line… Tonycoz
- CVE-2026-62063 MEDIUM · 5.4 Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1.
- CVE-2026-62061 MEDIUM · 5.3 Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 6.0.0.2.
- CVE-2026-62060 HIGH · 7.6 Onjuiste neutralisatie van speciale elementen die worden gebruikt in een SQL Command ('SQL Injection') -kwetsbaarheid in captivateaudio Captivate Sync captivatesync-trade maakt Blind SQL Injection mogelijk.…
- CVE-2026-62059 HIGH · 7.6 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects…
- CVE-2026-62058 MEDIUM · 5.3 Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through…
- CVE-2026-103345 MEDIUM · 5.3 Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a…
- CVE-2026-103343 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XSS.This issue affects FluentForm: from n/a…
- CVE-2026-103341 MEDIUM · 5.3 Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects…
- CVE-2026-103340 MEDIUM · 5.3 Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2.
- CVE-2026-103339 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet Metform metform allows Stored XSS.This issue affects Metform: from n/a through 4.3.0.