CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-118375 HIGH · 8.1 llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack.…
- CVE-2026-118373 LOW · 3.7 LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path…
- CVE-2026-118371 LOW · 3.7 LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request…
- CVE-2026-118274 MEDIUM · 4.3 A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the…
- CVE-2026-117610 MEDIUM · 5.9 libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream… Libexpat Project
- CVE-2026-117606 MEDIUM · 5.4 NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the…
- CVE-2026-117608 MEDIUM · 6.1 Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can…
- CVE-2026-115624 MEDIUM · 5.3 GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user,…
- CVE-2026-109848 MEDIUM · 4.2 GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By…
- CVE-2026-105272 MEDIUM · 4.2 GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability,…
- CVE-2015-20129 HIGH · 8.8 CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can…
- CVE-2014-125137 MEDIUM · 6.5 C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of…
- CVE-2013-20007 HIGH · 7.2 Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter.…
- CVE-2013-20009 MEDIUM · 4.8 Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can…
- CVE-2026-118271 MEDIUM · 4.3 A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component data-context…
- CVE-2026-110879 CRITICAL · 9.8 jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared…
- CVE-2026-110747 HIGH · 7.5 ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len)
- CVE-2026-104895 HIGH · 7.5 The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no…
- CVE-2026-104016 HIGH · 7.5 ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both use…
- CVE-2026-41709 CRITICAL · 9.5 Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. Required… Broadcom
- CVE-2026-46300 CRITICAL · 9.5 In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to… Linux
- CVE-2026-58256 CRITICAL · 9.1 GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration…
- CVE-2026-22063 NONE The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this…
- CVE-2026-118359 HIGH · 8.8 Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… Google
- CVE-2026-118358 HIGH · 8.8 Use after free in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… Google
- CVE-2026-118357 HIGH · 8.8 Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted… Google
- CVE-2026-118356 HIGH · 8.8 Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a… Google
- CVE-2026-118355 CRITICAL · 9.6 Use after free in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… Google
- CVE-2026-118354 HIGH · 8.8 Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security… Google
- CVE-2026-118353 HIGH · 8.8 Missing authorization in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security… Google
- CVE-2026-118352 HIGH · 8.8 Use after free in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted… Google
- CVE-2026-118351 HIGH · 8.8 Use after free in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted… Google
- CVE-2026-118350 HIGH · 8.8 Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… Google
- CVE-2026-118349 HIGH · 8.8 Use after free in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the… Google
- CVE-2026-118348 HIGH · 8.8 Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… Google
- CVE-2026-118347 HIGH · 8.8 Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… Google
- CVE-2026-118346 HIGH · 8.8 Out of bounds read in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process and leveraged social… Google
- CVE-2026-118345 HIGH · 8.8 Buffer overflow in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF… Google
- CVE-2026-118343 HIGH · 8.8 Use after free in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox… Google
- CVE-2026-118342 CRITICAL · 9.6 Use after free in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… Google
- CVE-2026-118340 CRITICAL · 9.6 Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security… Google
- CVE-2026-118338 HIGH · 8.8 Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security… Google
- CVE-2026-118337 CRITICAL · 9.3 Use after free in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… Google
- CVE-2026-118336 HIGH · 8.8 Race condition in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… Google
- CVE-2026-118335 HIGH · 8.8 Out of bounds write in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process… Google Apple
- CVE-2026-118333 CRITICAL · 9.3 Buffer overflow in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… Google
- CVE-2026-118332 CRITICAL · 9.6 Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary… Google
- CVE-2026-118331 HIGH · 8.8 Use after free in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted… Google
- CVE-2026-118330 HIGH · 8.8 Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to execute arbitrary code… Google Microsoft
- CVE-2026-118329 HIGH · 8.8 Uninitialized resource in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to read memory outside the sandbox via a… Google Apple