CVE-database
129.550 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-18734 NONE Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this…
- CVE-2026-17053 MEDIUM · 4.4 De API van het SMBus-stuurprogramma stelde smbus_smbalert_remove_cb() en smbus_host_notify_remove_cb() bloot als Zephyr-syscalls. Hun verificateurs in drivers/smbus/smbus_handlers.c valideerden alleen het dev-argument met K_SYSCALL_obj(dev, K_OBJ_DRIVER_SMBUS) en stuurden…
- CVE-2026-12627 CRITICAL · 9.8 Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may…
- CVE-2026-103690 MEDIUM · 6.3 A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the…
- CVE-2026-103505 MEDIUM · 6.5 Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with…
- CVE-2026-101322 NONE In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing requests…
- CVE-2026-97297 HIGH · 7.6 Subscriber Broken Access Control in Gratisfaction
- CVE-2026-97284 HIGH · 8.8 Contributor PHP Object Injection in Icegram
- CVE-2026-97281 MEDIUM · 6.3 Subscriber Broken Access Control in WP Project Manager
- CVE-2026-97280 MEDIUM · 6.5 Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0.
- CVE-2026-97277 HIGH · 7.6 Subscriber Broken Access Control in Social Boost
- CVE-2026-97273 HIGH · 7.1 Niet-geverifieerde Cross Site Scripting (XSS) in Premmerce Wishlist voor WooCommerce
- CVE-2026-97269 MEDIUM · 6.5 Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels
- CVE-2026-97268 HIGH · 7.1 Niet-geverifieerde Cross Site Scripting (XSS) in Premmerce Wishlist voor WooCommerce
- CVE-2026-97260 HIGH · 7.1 Niet-geverifieerde Cross Site Scripting (XSS) in MaxGalleria
- CVE-2026-97258 MEDIUM · 6.5 Subscriber Broken Access Control in Aruba Migration Tool
- CVE-2026-97251 MEDIUM · 6.5 Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation
- CVE-2026-95588 HIGH · 8.6 Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter
- CVE-2026-95137 NONE Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not…
- CVE-2026-94390 HIGH · 7.2 Editor PHP Object Injection in Hide Shipping Method For WooCommerce
- CVE-2026-79900 MEDIUM · 6.5 boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name…
- CVE-2026-79899 HIGH · 7.9 Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local…
- CVE-2026-79898 CRITICAL · 9.1 Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP…
- CVE-2026-67106 MEDIUM · 5.3 HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker… Hcltech
- CVE-2026-67105 HIGH · 7.4 HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic… Hcltech
- CVE-2026-67104 MEDIUM · 5.3 HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the… Hcltech
- CVE-2026-62073 HIGH · 7.5 Unauthenticated Broken Access Control in WP Full Stripe Free
- CVE-2026-62071 CRITICAL · 9.3 Unauthenticated SQL Injection in WordPress File Upload
- CVE-2026-56599 LOW · 2.2 HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as… Hcltech
- CVE-2026-56589 HIGH · 7.2 HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within… Hcltech
- CVE-2026-103752 CRITICAL · 9.8 Unauthenticated Privilege Escalation in Authorizer
- CVE-2026-103687 HIGH · 7.3 A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component…
- CVE-2026-103347 MEDIUM · 5.3 Unauthenticated Bypass Vulnerability in hCaptcha for WP
- CVE-2026-103068 HIGH · 8.8 Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools
- CVE-2026-103004 MEDIUM · 5.3 Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With… Vercel
- CVE-2026-102378 HIGH · 7.1 Niet-geauthenticeerde Cross-Site Scripting (XSS) in Parallax Section-blokken
- CVE-2026-100517 HIGH · 7.5 Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce
- CVE-2026-100514 HIGH · 7.5 Unauthenticated Insecure Direct Object References (IDOR) in REST API Log
- CVE-2024-58388 NONE Sharp (en Toshiba Tec omgedoopt) multifunctionele printers bevatten een niet-geverifieerde kwetsbaarheid voor het opnemen van lokale bestanden waarmee externe aanvallers willekeurige bestanden kunnen lezen door…
- CVE-2026-79901 CRITICAL · 9.9 In implementaties met BoKS keytab-beheer genereren de betreffende versies van boks_keytabmd Active Directory-serviceaccountwachtwoorden uit een voorspelbare pseudo-willekeurige reeks met de huidige Unix-tijdstempel. Een aanvaller die…
- CVE-2026-66253 LOW · 3.1 iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access to…
- CVE-2026-66249 LOW · 3.1 iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized…
- CVE-2026-66248 LOW · 3.1 iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure…
- CVE-2026-66247 MEDIUM · 4.3 iControl wordt beïnvloed door een onveilig CORS-beleid (Cross-Origin Resource Sharing), waardoor een kwaadaardige website cross-origin-verzoeken kan uitvoeren met inbegrepen inloggegevens, waardoor een aanvaller gevoelige gegevens…
- CVE-2026-66246 HIGH · 8.8 iControl wordt beïnvloed door een Broken Access Control-kwetsbaarheid, waardoor een aanvaller misbruik kan maken van ontbrekende authenticatiecontroles of onveilige directe objectverwijzingen (IDOR), waardoor privilege-escalatie en…
- CVE-2026-103686 LOW · 3.5 A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation.…
- CVE-2026-102505 MEDIUM · 6.3 Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with… Tonycoz
- CVE-2026-102504 HIGH · 7.5 Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line… Tonycoz
- CVE-2026-62063 MEDIUM · 5.4 Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1.
- CVE-2026-62061 MEDIUM · 5.3 Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 6.0.0.2.