CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-120956 HIGH · 7.1 The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB…
- CVE-2026-120955 HIGH · 7.5 The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file…
- CVE-2026-120954 LOW · 3.7 A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described…
- CVE-2026-120953 MEDIUM · 4.3 A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses…
- CVE-2026-120684 MEDIUM · 6.5 A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file…
- CVE-2026-120678 HIGH · 7.5 A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is…
- CVE-2026-120673 MEDIUM · 5.5 A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In…
- CVE-2026-119922 HIGH · 8.8 Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish may allow remote…
- CVE-2026-112917 NONE In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK.…
- CVE-2026-63499 NONE zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction…
- CVE-2026-63494 NONE Rejected reason: This CVE is a duplicate of another CVE.
- CVE-2026-63492 NONE Rejected reason: This CVE is a duplicate of another CVE.
- CVE-2026-63436 MEDIUM · 6.1 zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files…
- CVE-2026-63418 HIGH · 7.0 Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host…
- CVE-2026-44267 CRITICAL · 9.8 Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor…
- CVE-2026-44266 CRITICAL · 9.8 Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings…
- CVE-2026-44265 HIGH · 7.4 Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output,…
- CVE-2026-121628 LOW · 3.7 Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can…
- CVE-2026-121627 MEDIUM · 6.1 buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark…
- CVE-2026-121626 LOW · 3.7 GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe…
- CVE-2026-121625 LOW · 3.7 GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received…
- CVE-2026-121624 MEDIUM · 6.8 Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted…
- CVE-2026-121263 MEDIUM · 6.3 A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of…
- CVE-2026-116845 MEDIUM · 5.4 NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and…
- CVE-2026-97072 MEDIUM · 4.3 Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
- CVE-2026-39777 MEDIUM · 4.3 Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.
- CVE-2026-39743 MEDIUM · 5.3 Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.
- CVE-2026-38601 NONE A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via…
- CVE-2026-38600 CRITICAL · 9.8 A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.
- CVE-2026-38595 CRITICAL · 9.8 An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the…
- CVE-2026-28336 CRITICAL · 9.9 SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is…
- CVE-2026-28335 HIGH · 8.4 SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is required.
- CVE-2026-28327 HIGH · 8.2 SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine…
- CVE-2026-121631 MEDIUM · 4.2 Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access…
- CVE-2026-121604 LOW · 3.3 wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set…
- CVE-2026-121603 MEDIUM · 6.5 Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason.…
- CVE-2026-121602 MEDIUM · 6.5 Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in…
- CVE-2026-121588 MEDIUM · 6.1 TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons.…
- CVE-2026-121587 MEDIUM · 5.3 Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and…
- CVE-2026-121262 MEDIUM · 5.3 Er is een kwetsbaarheid gevonden in phpMyAdmin SQL-Parser 6.0.0/6.0.1. Het getroffen element is de functieparse van het bestand src/Statements/ExplainStatement.php. Het uitvoeren van een manipulatie van…
- CVE-2026-121261 MEDIUM · 4.3 A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads…
- CVE-2026-121259 MEDIUM · 6.5 A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during…
- CVE-2026-120846 MEDIUM · 5.3 Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through 7.7.1.
- CVE-2026-120843 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Stored XSS.This issue…
- CVE-2026-119675 HIGH · 8.6 MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection…
- CVE-2026-119674 LOW · 3.7 MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who…
- CVE-2026-119673 LOW · 2.8 MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS…
- CVE-2026-119672 MEDIUM · 4.8 MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when --local is not specified. A user who can modify…
- CVE-2026-119521 MEDIUM · 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions:…
- CVE-2026-119509 MEDIUM · 5.3 Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ClickCease Click Fraud Protection: from…