CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-65213 MEDIUM · 6.6 This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC
- CVE-2026-65211 HIGH · 7.2 This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.
- CVE-2026-65220 HIGH · 8.8 A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.
- CVE-2026-65219 HIGH · 7.4 A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an…
- CVE-2026-65210 MEDIUM · 4.9 This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.
- CVE-2026-18451 LOW · 3.1 The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session…
- CVE-2026-18450 CRITICAL · 9.8 The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands…
- CVE-2026-18449 HIGH · 7.5 The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands…
- CVE-2026-16521 HIGH · 7.2 An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may…
- CVE-2026-111461 NONE An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges…
- CVE-2026-111460 NONE A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and…
- CVE-2026-111459 NONE An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between…
- CVE-2026-107472 NONE An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt.…
- CVE-2026-101034 NONE An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmitted by GSS Deployment…
- CVE-2026-110910 LOW · 3.7 ### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default. A key…
- CVE-2026-105946 NONE Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap…
- CVE-2026-117472 MEDIUM · 4.3 Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured…
- CVE-2026-117471 MEDIUM · 5.4 Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo…
- CVE-2026-117470 MEDIUM · 6.5 Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed…
- CVE-2026-117469 MEDIUM · 5.4 Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with…
- CVE-2026-117468 MEDIUM · 6.5 Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote…
- CVE-2026-88781 NONE Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to subsequent system…
- CVE-2026-116841 MEDIUM · 5.5 DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index…
- CVE-2026-116838 HIGH · 8.8 A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices…
- CVE-2026-116837 HIGH · 8.8 A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices…
- CVE-2026-116836 HIGH · 8.8 A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M…
- CVE-2025-71439 MEDIUM · 5.5 llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can…
- CVE-2026-116827 MEDIUM · 6.8 YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests…
- CVE-2026-116823 MEDIUM · 6.1 YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching missing Bazar field names.…
- CVE-2026-116819 HIGH · 8.5 OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers…
- CVE-2026-116814 MEDIUM · 6.5 OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access…
- CVE-2026-116810 MEDIUM · 5.3 OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers…
- CVE-2026-116806 MEDIUM · 5.4 OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion…
- CVE-2026-116802 MEDIUM · 6.1 DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not…
- CVE-2026-48356 CRITICAL · 9.5 Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of… Adobe
- CVE-2026-76654 MEDIUM · 5.8 An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to…
- CVE-2026-116747 HIGH · 8.1 Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When…
- CVE-2026-116743 MEDIUM · 5.5 libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can…
- CVE-2026-116739 MEDIUM · 4.3 VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can…
- CVE-2026-116735 MEDIUM · 6.1 libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries.…
- CVE-2026-116731 MEDIUM · 6.1 Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES…
- CVE-2026-116727 LOW · 3.3 gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply…
- CVE-2026-116723 HIGH · 7.8 FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field.…
- CVE-2026-86992 HIGH · 7.5 The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden… Apple
- CVE-2026-86991 HIGH · 7.5 A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS… Apple
- CVE-2026-86990 MEDIUM · 5.1 An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.2 and iPadOS 26.7.2, iOS… Apple
- CVE-2026-86986 HIGH · 7.5 A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS… Apple
- CVE-2026-86989 MEDIUM · 5.1 An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An… Apple
- CVE-2026-86988 MEDIUM · 4.3 The issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2,… Apple
- CVE-2026-86985 MEDIUM · 6.5 This issue was addressed with improved input validation. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2,… Apple