CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-95735 HIGH · 8.7 An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker, under certain preconditions outside the attacker's…
- CVE-2026-95734 HIGH · 8.8 A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what…
- CVE-2026-95733 CRITICAL · 9.6 A vulnerability exists in a component of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the…
- CVE-2026-95732 CRITICAL · 9.6 An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute…
- CVE-2026-95731 CRITICAL · 9.8 Hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access the affected system using hardcoded…
- CVE-2026-95730 MEDIUM · 6.5 A buffer overflow vulnerability exists in HPE Networking VIA that could allow an authenticated low-privileged local user to cause a denial of service. Successful exploitation…
- CVE-2026-95729 MEDIUM · 6.5 A sensitive information disclosure vulnerability exists in HPE Networking VIA. Successful exploitation could allow an authenticated attacker to obtain sensitive information.
- CVE-2026-95728 HIGH · 7.1 An arbitrary file write vulnerability exists in the Virtual Intranet Access (VIA) client. Successful exploitation could allow a local attacker with low privileges to escalate…
- CVE-2026-95727 HIGH · 7.2 A command injection vulnerability exists in HPE Networking VIA. Successful exploitation could allow an authenticated administrative user to execute arbitrary commands with elevated privileges on…
- CVE-2026-95726 HIGH · 7.5 A buffer overflow vulnerability in HPE Networking VIA could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow…
- CVE-2026-95725 HIGH · 7.8 A command injection vulnerability exists in the VIA client for Linux. Successful exploitation could allow a low-privileged local attacker to execute arbitrary commands with elevated…
- CVE-2026-95724 HIGH · 8.1 An improper certificate validation vulnerability exists in HPE Networking Virtual Intranet Access (VIA). Successful exploitation could allow an unauthenticated remote attacker to bypass authentication mechanisms,…
- CVE-2026-95723 HIGH · 8.4 A missing integrity verification vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a low-privileged local…
- CVE-2026-95722 HIGH · 8.8 A local privilege escalation vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a local attacker…
- CVE-2026-93325 NONE Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that…
- CVE-2026-88968 NONE Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound…
- CVE-2026-88066 NONE Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path,…
- CVE-2026-63502 HIGH · 8.3 Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.file_name from the…
- CVE-2026-63501 HIGH · 7.5 ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but…
- CVE-2026-63500 HIGH · 7.1 Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, core/schemas/dfiq.py accepts an unvalidated uuid…
- CVE-2026-63489 HIGH · 7.6 Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates…
- CVE-2026-63482 HIGH · 7.5 Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router…
- CVE-2026-63478 MEDIUM · 5.3 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry…
- CVE-2026-63476 MEDIUM · 4.3 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta…
- CVE-2026-63475 MEDIUM · 4.3 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve()…
- CVE-2026-63471 NONE fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted…
- CVE-2026-63470 NONE fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping…
- CVE-2026-63469 NONE fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as…
- CVE-2026-63434 MEDIUM · 4.3 MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit…
- CVE-2026-63433 MEDIUM · 6.8 MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption…
- CVE-2026-63395 HIGH · 8.8 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory…
- CVE-2026-54161 HIGH · 8.1 Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to…
- CVE-2026-45146 HIGH · 7.2 Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true…
- CVE-2026-121577 NONE Inefficient Regular Expression Complexity (CWE-1333) in generate_regex() (whatstk/whatsapp/parser.py) in whatstk from 0.2.0 before 0.9.0 allows a party that supplies a chat export to consume the…
- CVE-2026-120567 MEDIUM · 5.4 The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that…
- CVE-2026-110826 NONE Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the…
- CVE-2026-105822 NONE The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker…
- CVE-2026-105821 NONE The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The…
- CVE-2025-71452 MEDIUM · 6.1 Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such…
- CVE-2025-71451 MEDIUM · 6.1 Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such…
- CVE-2026-82976 HIGH · 7.1 A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with…
- CVE-2026-63417 NONE Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7,…
- CVE-2026-63198 HIGH · 7.3 traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted…
- CVE-2026-63197 HIGH · 7.3 traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content…
- CVE-2026-57154 HIGH · 8.1 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected…
- CVE-2026-46487 HIGH · 7.5 GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter…
- CVE-2026-39379 HIGH · 7.1 GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause…
- CVE-2026-121652 MEDIUM · 5.4 Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1)…
- CVE-2026-121501 MEDIUM · 6.3 A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function session_regenerate_id of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID…
- CVE-2026-121382 HIGH · 7.5 A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow.…