CVE-database
133.515 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-104912 NONE MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system…
- CVE-2026-104910 NONE MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the…
- CVE-2026-104908 NONE MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging…
- CVE-2026-104907 NONE MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders…
- CVE-2026-104906 NONE MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was…
- CVE-2026-104901 NONE MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote)…
- CVE-2026-104900 NONE MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated…
- CVE-2026-104847 NONE ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice…
- CVE-2026-104846 CRITICAL · 9.8 Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass…
- CVE-2026-104845 HIGH · 7.5 Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as…
- CVE-2026-104844 MEDIUM · 5.9 PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a…
- CVE-2026-104843 NONE uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel…
- CVE-2026-103648 CRITICAL · 9.1 Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured…
- CVE-2026-103631 HIGH · 8.8 Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… Google
- CVE-2026-103630 CRITICAL · 9.6 Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted… Google
- CVE-2026-103629 MEDIUM · 4.3 Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security… Google
- CVE-2026-103628 CRITICAL · 9.6 Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a… Google
- CVE-2026-103627 MEDIUM · 6.5 Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security… Google
- CVE-2026-103626 CRITICAL · 9.6 Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code… Google Microsoft
- CVE-2026-103625 HIGH · 8.8 Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… Google
- CVE-2026-103624 HIGH · 8.3 Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the renderer process… Google Microsoft
- CVE-2026-103623 HIGH · 8.8 Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… Google
- CVE-2026-103622 HIGH · 8.8 Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… Google
- CVE-2026-103621 MEDIUM · 4.3 Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security… Google
- CVE-2026-101104 HIGH · 7.7 The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do…
- CVE-2026-90970 CRITICAL · 9.9 GitLab heeft een kwetsbaarheid in de GitLab AI Gateway-component verholpen die van invloed was op alle versies van de AI Gateway van 18.1.6 vóór 19.2.4,…
- CVE-2026-5782 MEDIUM · 5.2 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in MRV Technology Foreign Trade Ltd. Co. TurkHotspot allows Reflected XSS. This issue affects…
- CVE-2026-39717 MEDIUM · 4.3 Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.
- CVE-2026-39601 LOW · 3.7 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from…
- CVE-2026-39600 MEDIUM · 4.7 URL Doorverwijzing naar Untrusted Site ('Open Redirect') kwetsbaarheid in Mehul Gohil Aculect AI Companion aculect-ai-companion maakt phishing mogelijk. Dit probleem heeft invloed op Aculect AI…
- CVE-2026-39444 MEDIUM · 5.4 Authorization Bypass Through User-Controlled Key vulnerability in PublishPress PublishPress Series organize-series allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Series: from n/a…
- CVE-2026-39439 MEDIUM · 6.5 Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebSamurai: from n/a through 1.0.7.
- CVE-2026-32585 MEDIUM · 6.5 Ontbrekende autorisatiekwetsbaarheid in airano Airano MCP Bridge airano-mcp-bridge maakt het mogelijk om onjuist geconfigureerde toegangscontrolebeveiligingsniveaus te exploiteren. Dit probleem heeft invloed op Airano MCP Bridge:…
- CVE-2026-32584 MEDIUM · 5.3 Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup allows Retrieve Embedded…
- CVE-2026-104638 MEDIUM · 5.3 A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The impacted element is an unknown function of the file php/sessions.php. The manipulation…
- CVE-2026-104637 HIGH · 7.3 A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the function add_patient/add_physician/add_account/update_account/update_subaccount/edit_physician/edit_patient of the file php/controller.php. Executing a manipulation…
- CVE-2026-104625 MEDIUM · 6.3 A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation…
- CVE-2026-104026 HIGH · 7.8 In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a…
- CVE-2026-94422 HIGH · 8.8 An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus…
- CVE-2026-93875 HIGH · 7.2 The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to…
- CVE-2026-85215 HIGH · 7.1 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GG Soft Software Services Inc. Paperwork allows SQL Injection. This issue…
- CVE-2026-19652 CRITICAL · 9.8 The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function…
- CVE-2026-104721 NONE Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender…
- CVE-2026-104614 MEDIUM · 6.3 A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /SimplePharmacy-PHP/product/delete.php. Such manipulation of the…
- CVE-2026-104613 MEDIUM · 6.3 A vulnerability was determined in CodeAstro Simple Pharmacy Management System 1.0. This vulnerability affects unknown code of the file /SimplePharmacy-PHP/product/view.php. This manipulation of the argument…
- CVE-2026-96289 NONE Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes…
- CVE-2026-96287 NONE Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which…
- CVE-2026-96286 NONE Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes…
- CVE-2026-96277 NONE Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade…
- CVE-2026-94658 NONE Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which…