CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-121390 MEDIUM · 4.3 FreeRDP 3.0.0 before 3.32.2 built with WITH_AAD=ON contains a reachable assertion because its ARM gateway response parser accepts a missing or non-string redirectedServerCert field and… Freerdp
- CVE-2026-121389 LOW · 3.1 FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious RDP servers to abort clients by sending malformed RDPDR… Freerdp
- CVE-2026-121388 MEDIUM · 6.5 FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATA_FIRST… Freerdp
- CVE-2026-121387 MEDIUM · 4.3 FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610… Freerdp
- CVE-2026-121386 HIGH · 7.5 FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_convert_from_jpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM… Freerdp
- CVE-2026-118489 HIGH · 7.5 In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a…
- CVE-2026-118488 MEDIUM · 5.9 In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an EOL-terminated line (not length-prefixed, for example a…
- CVE-2026-110265 MEDIUM · 6.5 A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's hosted environment found only testing of the…
- CVE-2026-106991 HIGH · 7.1 hustoj >=24.09.10 and
- CVE-2026-100493 NONE An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an…
- CVE-2026-89295 HIGH · 7.5 In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count}…
- CVE-2026-85035 HIGH · 8.8 The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in drivers/can/can_common.c) is handed the caller's struct k_msgq * as user_data. The controller…
- CVE-2026-85034 MEDIUM · 6.7 The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Multiple Handle Value Notification to bt_gatt_subscribe_params::notify callbacks…
- CVE-2026-85033 MEDIUM · 4.6 The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index (get_avrcp_tg()), with the per-transfer context…
- CVE-2026-85032 MEDIUM · 4.8 The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system workqueue runs mctp_usb_class_out_work(), which parses host OUT data byte…
- CVE-2026-120572 HIGH · 8.8 Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1.
- CVE-2026-119742 HIGH · 7.2 Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with…
- CVE-2026-119179 HIGH · 7.0 A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data…
- CVE-2026-99270 HIGH · 8.1 In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(),…
- CVE-2026-76124 HIGH · 8.8 The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This…
- CVE-2026-65160 MEDIUM · 5.5 NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero. A successful exploit of this vulnerability might lead to denial of service.
- CVE-2026-121458 MEDIUM · 6.5 Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to…
- CVE-2026-108060 NONE A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to…
- CVE-2026-108059 NONE A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to…
- CVE-2026-108058 NONE A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to…
- CVE-2026-108057 NONE A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to…
- CVE-2026-108056 NONE A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to…
- CVE-2026-108055 NONE A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to…
- CVE-2026-108054 NONE Een opgeslagen Cross-Site Scripting (XSS) -kwetsbaarheid in Alosuite die de functionaliteit van de leveringsbon beïnvloedt. Door onvoldoende ontsmetting en codering van de opgegeven velden kan…
- CVE-2026-108053 NONE A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to…
- CVE-2026-108052 NONE A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to…
- CVE-2026-108051 NONE A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to…
- CVE-2026-108050 NONE A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to…
- CVE-2026-108049 NONE Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does…
- CVE-2026-108048 NONE Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or…
- CVE-2026-108047 NONE Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker…
- CVE-2026-108046 NONE Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By modifying the identifier provided to the ‘/Companies/Edit/{id}’ endpoint,…
- CVE-2026-99269 HIGH · 7.8 In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs A task can be found on…
- CVE-2026-99268 NONE Reden van afwijzing: deze CVE-ID is afgewezen of ingetrokken door de CVE-nummeringsinstantie.
- CVE-2026-99267 NONE Reden van afwijzing: deze CVE-ID is afgewezen of ingetrokken door de CVE-nummeringsinstantie.
- CVE-2026-99266 NONE Reden van afwijzing: deze CVE-ID is afgewezen of ingetrokken door de CVE-nummeringsinstantie.
- CVE-2026-99265 NONE Reden van afwijzing: deze CVE-ID is afgewezen of ingetrokken door de CVE-nummeringsinstantie.
- CVE-2026-99264 NONE Reden van afwijzing: deze CVE-ID is afgewezen of ingetrokken door de CVE-nummeringsinstantie.
- CVE-2026-99263 NONE Reden van afwijzing: deze CVE-ID is afgewezen of ingetrokken door de CVE-nummeringsinstantie.
- CVE-2026-99262 NONE Reden van afwijzing: deze CVE-ID is afgewezen of ingetrokken door de CVE-nummeringsinstantie.
- CVE-2026-99261 NONE In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move…
- CVE-2026-99260 NONE In the Linux kernel, the following vulnerability has been resolved: ntfs: fix resident conversion in ntfs_new_attr_flags When setting sparse/compressed flags on a resident attribute, the…
- CVE-2026-99259 NONE In the Linux kernel, the following vulnerability has been resolved: soc/tegra: pmc: Fix uninitialised clock rate For legacy 32-bit Tegra devices, the warning in the…
- CVE-2026-99258 NONE In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() hv_apicid_to_vp_index() currently uses the per-cpu hypercall input…
- CVE-2026-99257 NONE In the Linux kernel, the following vulnerability has been resolved: gpio: shared: gracefully handle no-device lookup of shared GPIOs We use platform lookup tables for…