CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-114644 MEDIUM · 5.9 De BSON-bibliotheek van de MongoDB C#-driver bevat een zwak punt in het ongecontroleerde resourceverbruik bij de deserialisatie van één specifiek BSON-waardetype. Een applicatie die onbetrouwbare…
- CVE-2026-114643 MEDIUM · 5.4 The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application…
- CVE-2026-114613 HIGH · 7.5 MessagePack is de serialisatie-implementatie voor Python msgpack.org. Voorafgaand aan 1.2.3 lekt de msgpack-python C-extensie (msgpack._cmsgpack) een gedecodeerde kaartwaarde wanneer deserialisatie een sleutel met strict_map_key=True (de…
- CVE-2026-114612 CRITICAL · 9.9 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2,…
- CVE-2026-114519 NONE Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read…
- CVE-2026-113876 MEDIUM · 4.3 SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create…
- CVE-2026-113875 LOW · 3.1 On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read…
- CVE-2025-69723 NONE Een XSS-kwetsbaarheid (reflected cross-site scripting) in localstack v4.9.2 stelt aanvallers in staat om willekeurige JavaScript-code uit te voeren in de browser van de gebruiker via…
- CVE-2025-65200 NONE An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said…
- CVE-2022-51026 CRITICAL · 9.8 Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied…
- CVE-2026-97635 HIGH · 8.1 The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in…
- CVE-2026-93336 NONE Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login…
- CVE-2026-77157 MEDIUM · 6.4 ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the…
- CVE-2026-77156 MEDIUM · 6.4 Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and…
- CVE-2026-54532 MEDIUM · 6.9 CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workflow is vulnerable to cache poisoning and OIDC token…
- CVE-2026-54238 LOW · 3.1 Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp…
- CVE-2026-13599 HIGH · 7.8 Ontbrekende authenticatie voor kritieke functionaliteitskwetsbaarheid in ABB Ability Edgenius. Dit probleem treft Ability Edgenius tot en met versie 3.2.3.0.
- CVE-2026-115516 NONE Reden van afwijzing: deze CVE-ID is afgewezen of ingetrokken door de CVE-nummeringsinstantie.
- CVE-2026-114611 CRITICAL · 9.1 OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies…
- CVE-2026-114610 MEDIUM · 6.5 fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior…
- CVE-2026-114609 MEDIUM · 5.8 fpdf2 is een Python-bibliotheek voor het maken van PDF-bestanden. Vóór versie 2.8.8 dereferentieerde de gedeelde afbeeldingslader van fpdf2 automatisch door aanvallers beheerde HTTP(S)-URL's en onbewerkte…
- CVE-2026-113874 HIGH · 8.1 SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition…
- CVE-2026-113873 HIGH · 7.5 SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain…
- CVE-2026-108360 MEDIUM · 6.4 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, WorksheetDrawing::setPath validates only the initial…
- CVE-2026-108359 NONE PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an…
- CVE-2026-108358 NONE PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a…
- CVE-2026-108357 NONE PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, ReaderXml passes stored SpreadsheetML XML through XmlScanner::scan…
- CVE-2026-115513 HIGH · 8.7 OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact,…
- CVE-2026-75507 HIGH · 7.5 GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that…
- CVE-2026-114607 CRITICAL · 9.1 Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or…
- CVE-2026-104068 HIGH · 7.2 JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside…
- CVE-2026-114515 MEDIUM · 6.5 OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with…
- CVE-2026-94502 NONE In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages…
- CVE-2026-89410 NONE In Z-Wave SDK 8.1.1 en eerder kan een misvormde NCP SPI-opdracht buiten het bereik lezen dat gevoelige informatie lekt.
- CVE-2026-85080 NONE In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can…
- CVE-2026-66282 NONE In EmberZNet 9.1.1 en eerdere versies kan een onjuist geformuleerde opdracht voor het publiceren van de factureringsperiode resulteren in een recursieve functieaanroep die nooit de…
- CVE-2026-66281 NONE In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come…
- CVE-2026-66279 NONE In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption.…
- CVE-2026-115247 MEDIUM · 4.3 A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This vulnerability affects unknown code of the file patientregistration.php. The manipulation of the…
- CVE-2026-111497 CRITICAL · 9.8 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to… Google Nodejs Python-hyper Microsoft
- CVE-2026-115334 MEDIUM · 6.8 Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who…
- CVE-2026-115330 HIGH · 8.8 Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries.…
- CVE-2026-115333 MEDIUM · 5.9 Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret…
- CVE-2026-115329 MEDIUM · 5.9 Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users…
- CVE-2026-115326 MEDIUM · 5.4 QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers…
- CVE-2026-115325 HIGH · 8.3 Netmaker via 1.7.0 bevat een kwetsbaarheid voor het omzeilen van autorisaties in de updateExtClient-handler waarmee gebruikers met een netwerkscope externe clients op andere netwerken kunnen…
- CVE-2026-115322 MEDIUM · 4.3 Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID.…
- CVE-2026-115207 MEDIUM · 5.5 A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated…
- CVE-2026-115321 MEDIUM · 4.3 Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying…
- CVE-2026-111079 HIGH · 7.4 A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization…