CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-57142 HIGH · 7.8 PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block…
- CVE-2026-57121 HIGH · 8.1 PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects,…
- CVE-2026-57117 HIGH · 8.8 PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write_file when a…
- CVE-2026-57116 CRITICAL · 9.8 PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in…
- CVE-2026-57114 HIGH · 7.2 PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed…
- CVE-2026-57113 HIGH · 8.1 PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0.…
- CVE-2026-55889 NONE XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste…
- CVE-2026-55888 NONE XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access…
- CVE-2026-55422 MEDIUM · 4.6 conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using…
- CVE-2026-55190 MEDIUM · 6.5 Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, AppUtilsUrlUtils::isUrlSafe() is the SSRF guard…
- CVE-2026-54711 NONE pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database…
- CVE-2026-115752 MEDIUM · 4.2 Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers…
- CVE-2026-115751 LOW · 3.7 Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who…
- CVE-2026-115750 LOW · 3.7 mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin…
- CVE-2026-115749 LOW · 3.3 hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling…
- CVE-2026-115730 LOW · 3.1 i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers…
- CVE-2026-115729 MEDIUM · 6.8 @pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf…
- CVE-2026-115728 HIGH · 7.5 @hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers…
- CVE-2026-112863 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0.
- CVE-2026-112859 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
- CVE-2026-112858 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
- CVE-2026-112857 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
- CVE-2026-112856 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
- CVE-2026-112855 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.
- CVE-2026-112854 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
- CVE-2026-112853 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
- CVE-2026-112852 HIGH · 8.1 Deserialisatie van Untrusted Data-kwetsbaarheid in ThemeREX Group Helion helion maakt Object Injection mogelijk. Dit probleem heeft invloed op Helion: van n.v.t. tot en met 1.1.12.
- CVE-2026-112851 CRITICAL · 9.8 Deserialisatie van niet-vertrouwde gegevenskwetsbaarheid in ThemeREX Group HotLock-hotlock maakt objectinjectie mogelijk. Dit probleem heeft invloed op HotLock: van n.v.t. tot 1.3.9.
- CVE-2026-112850 HIGH · 8.1 Onjuiste controle van de bestandsnaam voor Include/Require Statement in PHP Program ('PHP Remote File Inclusion') kwetsbaarheid in AncoraThemes Your Dress your-dress staat PHP Local File…
- CVE-2026-112849 HIGH · 7.1 Onjuiste neutralisatie van invoer tijdens het genereren van webpagina's ('Cross-site Scripting') kwetsbaarheid in AivahThemes Hostme v2 hostmev2 maakt op dom gebaseerde XSS mogelijk. Dit probleem…
- CVE-2026-112848 CRITICAL · 9.8 Deserialisatie van niet-vertrouwde gegevenskwetsbaarheid in AivahThemes Hostme v2 hostmev2 maakt objectinjectie mogelijk. Dit probleem heeft invloed op Hostme v2: van n.v.t. tot en met 7.0.
- CVE-2026-112847 CRITICAL · 9.8 Deserialisatie van niet-vertrouwde gegevenskwetsbaarheid in ThemeREX ZenSoul zensoul maakt objectinjectie mogelijk. Dit probleem heeft invloed op ZenSoul: van n.v.t. tot en met 1.13.
- CVE-2026-112846 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.
- CVE-2026-98916 NONE In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color…
- CVE-2026-98915 NONE In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2_video_unregister_device on driver removal The driver uses vb2_fop_release() as its file release…
- CVE-2026-98914 NONE In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with execute_depth and…
- CVE-2026-98913 NONE In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvf_probe() cavium_ptp_get() acquires a reference to the…
- CVE-2026-98912 NONE In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the…
- CVE-2026-98911 HIGH · 7.5 In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the…
- CVE-2026-98910 NONE In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy_to_user failure If kfd_dbg_trap_enable() fails while copying runtime_info to…
- CVE-2026-98909 NONE In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before registering the CPSW…
- CVE-2026-98908 NONE In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5_tc_flower_psfp_setup() allocates PSFP stream…
- CVE-2026-98907 NONE In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb_write_pointer() with invalidate lock sb_write_pointer() reads the super block from the block device…
- CVE-2026-98906 NONE In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966x_fdma_reload() backs up rx->page_pool and rx->fdma before…
- CVE-2026-98905 NONE In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfd_queue_acquire_buffers() was split off from set_queue_properties_from_user(),…
- CVE-2026-98904 NONE In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm_pm_runtime_enable() sashiko complained about early usage of the device while probe isn't…
- CVE-2026-98903 NONE In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario…
- CVE-2026-98902 NONE In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm_seq comparison wrap-safe Once the 32-bit seq wraps, a newer bm_seq…
- CVE-2026-98901 NONE In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing…
- CVE-2026-98900 NONE In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the…