CVE-database
126.937 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-103250 HIGH · 8.1 Versies van n8n ouder dan 1.123.80, van 2.0.0 tot en met 2.39.6 en van 2.40.0 tot en met 2.40.1 bevatten een NoSQL-injectiekwetsbaarheid in het MongoDB…
- CVE-2026-103249 HIGH · 7.6 n8n-versies vóór 1.123,80, van 2.0.0 vóór 2.39.6 en van 2.40.0 vóór 2.40.1 bevatten een opgeslagen DOM-kwetsbaarheid voor cross-site scripting in het afhandelen van de vervolgkeuzelink…
- CVE-2026-103248 CRITICAL · 9.0 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode…
- CVE-2026-103247 HIGH · 8.5 n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared…
- CVE-2026-103246 HIGH · 7.7 n8n-versies vóór 2.39.6 en 2.40.0 vóór 2.40.1 slagen er niet in om het eigendom van referenties te valideren tijdens introspectie van inline agentknooppunt-tool. Aanvallers kunnen…
- CVE-2026-103245 MEDIUM · 5.3 n8n versies vóór 1.123,80, van 2.0.0 vóór 2.39.6, en van 2.40.0 vóór 2.40.1 slagen er niet in om de x-webflow-handtekening HMAC in de Webflow Trigger…
- CVE-2026-103244 CRITICAL · 9.8 grondstationversies vóór 0.8.0 bevatten een kwetsbaarheid voor het omzeilen van authenticatie in het commando setup.restore waarmee niet-geverifieerde aanvallers willekeurige SQL kunnen uitvoeren tijdens de eerste…
- CVE-2026-103082 HIGH · 7.2 Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor:…
- CVE-2026-96577 HIGH · 7.1 A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of…
- CVE-2026-96256 MEDIUM · 6.4 The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map…
- CVE-2026-92144 HIGH · 7.2 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in…
- CVE-2026-83589 MEDIUM · 6.1 A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit…
- CVE-2026-7176 NONE CVE-2026-7176: de Help-tekst en Titelparameters in het eindpunt /evenementen/-/custom_form/edit tijdens het proces van het maken of wijzigen van formulieren die zijn gekoppeld aan ticketverkoop voor…
- CVE-2026-7175 NONE CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code…
- CVE-2026-7174 NONE CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discount_wizard/discount_config during the process of creating…
- CVE-2026-7173 NONE CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the…
- CVE-2026-75786 NONE Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards.
- CVE-2026-64950 NONE Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora…
- CVE-2026-64949 NONE Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.
- CVE-2026-64948 NONE Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.
- CVE-2026-64947 NONE A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting…
- CVE-2026-64946 NONE A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account…
- CVE-2026-34190 NONE Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This…
- CVE-2026-34189 NONE Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This…
- CVE-2026-103497 MEDIUM · 5.5 In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration Jetbrains
- CVE-2026-103496 MEDIUM · 5.4 In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications Jetbrains
- CVE-2026-103495 MEDIUM · 4.3 In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs Jetbrains
- CVE-2026-103494 MEDIUM · 6.6 In JetBrains YouTrack vóór versie 2026.2.19422 was privilege-escalatie mogelijk via wijzigingen in het lidmaatschap van gebruikersgroepen. Jetbrains
- CVE-2026-103493 HIGH · 8.1 In JetBrains YouTrack vóór versie 2026.2.19422 was het mogelijk om via Mermaid en LaTeX-content XSS op te slaan. Jetbrains
- CVE-2026-103492 MEDIUM · 6.5 In JetBrains YouTrack was vóór 2026.2.19422 een DoS-aanval mogelijk via zelfgemaakte PSD-bijlagen. Jetbrains
- CVE-2026-103491 MEDIUM · 6.5 In JetBrains YouTrack vóór 2026.2.19422 stond iDOR in de issue-activiteiten API het lezen van beperkte problemen toe Jetbrains
- CVE-2026-103490 HIGH · 7.2 In JetBrains YouTrack vóór 2026.2.19422 was escalatie van bevoegdheden mogelijk via gebruikersgroeplinks Jetbrains
- CVE-2026-103489 LOW · 2.0 In JetBrains YouTrack vóór 2026.2.19422 was hTML-injectie in VCS-opdrachtfoutmeldingen mogelijk Jetbrains
- CVE-2026-103488 HIGH · 7.1 In JetBrains YouTrack vóór 2026.2.19422 stond het ontbreken van autorisatie geverifieerde gebruikers toe om zichzelf toe te voegen aan projectteams en toegang te krijgen tot… Jetbrains
- CVE-2026-97661 HIGH · 7.2 The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to,…
- CVE-2026-96813 HIGH · 7.2 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on…
- CVE-2026-96573 HIGH · 7.2 The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar…
- CVE-2026-96268 MEDIUM · 6.4 The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions…
- CVE-2026-95687 HIGH · 8.8 The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and…
- CVE-2026-92244 HIGH · 7.2 The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name /…
- CVE-2026-90992 MEDIUM · 6.4 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to,…
- CVE-2026-89427 MEDIUM · 6.1 The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions…
- CVE-2026-89424 MEDIUM · 6.4 The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, and including, 1.5.6 due…
- CVE-2026-85235 HIGH · 7.2 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field…
- CVE-2026-15983 HIGH · 8.1 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including,…
- CVE-2026-14995 HIGH · 7.2 The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient…
- CVE-2026-103664 NONE MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL,…
- CVE-2026-103662 NONE MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag). The affected forms echoed…
- CVE-2026-103659 NONE MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the…
- CVE-2026-103656 NONE Rejected reason: this is rejected