CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-112219 MEDIUM · 4.9 The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network…
- CVE-2026-111982 HIGH · 7.2 The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end…
- CVE-2026-111966 MEDIUM · 6.8 The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect…
- CVE-2026-111738 MEDIUM · 5.5 The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which…
- CVE-2026-111737 LOW · 3.5 The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages,…
- CVE-2026-110537 LOW · 3.8 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval…
- CVE-2026-110510 LOW · 3.5 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to…
- CVE-2026-109936 HIGH · 7.5 The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the…
- CVE-2026-109935 MEDIUM · 5.3 The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API,…
- CVE-2026-109934 MEDIUM · 5.3 The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API…
- CVE-2026-109933 MEDIUM · 6.8 The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing…
- CVE-2026-107858 NONE Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent Development…
- CVE-2026-86055 NONE Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it…
- CVE-2026-86020 MEDIUM · 4.6 Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part…
- CVE-2026-86019 NONE Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum…
- CVE-2026-86018 NONE Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment…
- CVE-2026-59188 MEDIUM · 5.4 Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename…
- CVE-2026-55835 NONE Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior…
- CVE-2026-115497 HIGH · 7.5 The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f'…
- CVE-2026-109198 HIGH · 7.2 The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions…
- CVE-2026-90458 MEDIUM · 5.4 OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.
- CVE-2026-89419 MEDIUM · 5.0 OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not…
- CVE-2026-55600 NONE Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter.…
- CVE-2026-54631 MEDIUM · 6.3 Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a…
- CVE-2026-54630 CRITICAL · 9.6 Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the…
- CVE-2026-54615 NONE Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of…
- CVE-2026-115638 MEDIUM · 4.3 OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip…
- CVE-2026-115547 CRITICAL · 9.1 An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage…
- CVE-2026-115546 HIGH · 8.1 Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source…
- CVE-2026-19678 NONE A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive…
- CVE-2026-19677 NONE An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain…
- CVE-2026-115537 MEDIUM · 4.3 A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function simpan of the file application/modules/admin/controllers/routing_pages.php of the component URL Validation.…
- CVE-2026-115536 MEDIUM · 4.3 A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The impacted element is the function simpan of the file application/modules/admin/controllers/routing_pages.php of the…
- CVE-2026-115535 LOW · 2.4 A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Settings…
- CVE-2026-115486 HIGH · 7.1 A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying…
- CVE-2026-115485 MEDIUM · 6.3 A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator…
- CVE-2026-115484 HIGH · 7.6 A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to…
- CVE-2026-115534 MEDIUM · 4.3 A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function kirim of the file application/modules/web/controllers/contact.php of the component Contact Form. Executing…
- CVE-2026-114625 CRITICAL · 9.5 Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host.… Arista
- CVE-2026-110447 CRITICAL · 9.5 Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution… Collabora
- CVE-2026-92450 HIGH · 7.5 The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string…
- CVE-2026-110825 HIGH · 7.5 The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the…
- CVE-2026-110491 HIGH · 7.5 The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new…
- CVE-2026-110243 CRITICAL · 9.9 The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration…
- CVE-2026-107861 CRITICAL · 9.9 The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it…
- CVE-2026-97785 CRITICAL · 10.0 Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-96616 MEDIUM · 6.5 Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them…
- CVE-2026-96185 HIGH · 7.5 Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
- CVE-2026-83938 CRITICAL · 10.0 Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-115449 LOW · 3.5 A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the…