CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-119120 HIGH · 7.5 Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace…
- CVE-2026-118673 NONE KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp…
- CVE-2026-118079 HIGH · 7.2 Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.
- CVE-2026-115795 NONE P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set…
- CVE-2026-115794 NONE P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without…
- CVE-2026-115793 NONE P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not…
- CVE-2026-112256 NONE Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects…
- CVE-2026-112255 NONE Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0…
- CVE-2026-112200 NONE P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has…
- CVE-2026-111736 NONE P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when handling an implicit read request without a valid target AR UUID for a user…
- CVE-2026-111735 NONE P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN…
- CVE-2026-111734 NONE P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET…
- CVE-2026-111733 NONE P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that…
- CVE-2026-111732 NONE P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the…
- CVE-2026-111731 NONE P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The loop over the…
- CVE-2026-111730 NONE P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) was used to copy…
- CVE-2026-110245 HIGH · 7.5 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication. Langflow
- CVE-2026-110192 MEDIUM · 6.5 IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials. Langflow
- CVE-2026-110200 MEDIUM · 6.5 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information. Langflow
- CVE-2026-107040 CRITICAL · 9.1 Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.
- CVE-2026-107038 CRITICAL · 9.1 Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of…
- CVE-2026-107035 MEDIUM · 6.5 Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into another user's private…
- CVE-2026-107033 MEDIUM · 6.5 Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database.
- CVE-2026-107029 CRITICAL · 9.1 Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.
- CVE-2026-107027 CRITICAL · 9.1 Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.
- CVE-2026-106036 NONE Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide…
- CVE-2026-104331 MEDIUM · 5.4 IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the… Langflow
- CVE-2026-104315 MEDIUM · 4.3 IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the… Langflow
- CVE-2026-104308 MEDIUM · 4.3 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements… Langflow
- CVE-2026-104312 LOW · 3.5 IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended… Langflow
- CVE-2026-102590 MEDIUM · 5.0 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability. Langflow
- CVE-2025-13050 MEDIUM · 5.4 Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user
- CVE-2026-107024 HIGH · 7.5 Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard content via supplying a crafted URL.
- CVE-2026-107021 CRITICAL · 9.1 Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization…
- CVE-2026-107018 HIGH · 8.1 Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage.
- CVE-2026-107016 HIGH · 7.5 Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.
- CVE-2026-93009 MEDIUM · 4.3 A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it…
- CVE-2026-93010 MEDIUM · 4.3 A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query.…
- CVE-2026-79589 CRITICAL · 9.8 The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell.…
- CVE-2026-119054 MEDIUM · 5.4 Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match]…
- CVE-2026-119051 MEDIUM · 5.9 flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can…
- CVE-2026-119050 HIGH · 8.1 Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr().…
- CVE-2019-25781 HIGH · 7.5 Python-Markdown 3.0 tot en met 3.11.2 bevat een algoritmische complexiteitskwetsbaarheid in inline linkparsing waarmee externe aanvallers de CPU via ongeëvenaarde beugels kunnen uitputten. Aanvallers kunnen…
- CVE-2026-93011 MEDIUM · 5.3 A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name…
- CVE-2026-93008 MEDIUM · 6.8 A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking…
- CVE-2026-93007 MEDIUM · 5.3 A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout…
- CVE-2026-93006 MEDIUM · 6.8 A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when…
- CVE-2026-49142 HIGH · 8.8 OpenEMR voor 8.5.0 bevat een geverifieerde SQL-injectiekwetsbaarheid in de Syndromic Surveillance-module waarmee gebruikers met rechten op clinicusniveau willekeurige database-inhoud kunnen lezen en wijzigen door bewerkte…
- CVE-2026-119025 HIGH · 7.5 open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL.…
- CVE-2026-116409 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Reflected XSS.This issue…