CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2025-71434 HIGH · 8.2 Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2.…
- CVE-2024-58396 HIGH · 7.5 YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers…
- CVE-2023-54413 MEDIUM · 6.1 WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input…
- CVE-2022-51022 CRITICAL · 9.1 YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete…
- CVE-2022-51025 MEDIUM · 6.5 Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of…
- CVE-2021-48015 HIGH · 7.5 JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send…
- CVE-2022-51021 HIGH · 8.2 De NotificationX-plugin voor WordPress 2.0.0 vóór 2.3.12 bevat een SQL-injectiekwetsbaarheid zonder authenticatie waarmee externe aanvallers databasequery's kunnen manipuleren door een array-vormige 'id'-parameter door te geven…
- CVE-2021-48014 CRITICAL · 9.8 FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers…
- CVE-2017-20290 MEDIUM · 6.1 Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can…
- CVE-2019-25779 HIGH · 7.5 WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can…
- CVE-2019-25778 HIGH · 8.2 SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter.…
- CVE-2017-20289 HIGH · 7.5 De Broadstreet Ad Widget-plugin voor WordPress 2.2.0 vóór 2.12.0 bevat een kwetsbaarheid voor het includeren van lokale bestanden. Hierdoor kunnen geauthenticeerde gebruikers door aanvallers gekozen…
- CVE-2026-96293 NONE A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to…
- CVE-2026-115253 NONE Een beveiligingslek in de logdirectory van de WatchGuard Agent, veroorzaakt door onjuiste toegangsrechten, stelt een lokale, geauthenticeerde gebruiker zonder beheerdersrechten in staat om logbestanden van…
- CVE-2026-114732 MEDIUM · 6.8 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an… Roundcube
- CVE-2026-114731 MEDIUM · 5.3 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched… Roundcube
- CVE-2026-114730 HIGH · 7.2 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted… Roundcube
- CVE-2026-114729 MEDIUM · 5.3 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from`… Roundcube
- CVE-2026-96376 MEDIUM · 6.4 Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud…
- CVE-2026-96355 CRITICAL · 9.1 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to…
- CVE-2026-114664 HIGH · 7.1 Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in…
- CVE-2026-114660 MEDIUM · 6.3 Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@…
- CVE-2026-114663 HIGH · 8.4 Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather…
- CVE-2026-114656 HIGH · 7.5 Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as… Traefik
- CVE-2026-114659 MEDIUM · 6.5 Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the…
- CVE-2026-114642 HIGH · 8.7 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's…
- CVE-2026-114639 HIGH · 8.7 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket… Traefik
- CVE-2026-114635 HIGH · 8.7 Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients… Traefik
- CVE-2026-114638 HIGH · 8.7 Traefik v3.7.0 voor v3.7.14 bevat een onjuist authenticatieprobleem in de Kubernetes Ingress NGINX-PROVIDER die client-CA's samenvoegt wanneer auth-tls-geheime namen botsen na dot-to-dash-normalisatie. Aanvallers met certificaten…
- CVE-2026-114634 MEDIUM · 4.3 WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-validating targets with isSSRFSafeURL(). Authenticated uploaders can…
- CVE-2026-114576 LOW · 3.7 A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation of the argument…
- CVE-2026-16255 MEDIUM · 5.9 GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the… Gitlab
- CVE-2026-14288 LOW · 3.1 GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain… Gitlab
- CVE-2026-13319 MEDIUM · 4.3 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have… Gitlab
- CVE-2026-15723 HIGH · 8.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth… Gitlab
- CVE-2026-12664 MEDIUM · 6.8 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain… Gitlab
- CVE-2026-112378 MEDIUM · 4.3 GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain… Gitlab
- CVE-2026-112326 LOW · 3.1 GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain… Gitlab
- CVE-2026-112212 HIGH · 7.5 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain… Gitlab
- CVE-2026-110264 CRITICAL · 10.0 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3… Gitlab
- CVE-2026-105777 MEDIUM · 4.3 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain… Gitlab
- CVE-2026-105711 LOW · 3.5 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a… Gitlab
- CVE-2026-103515 LOW · 2.7 GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an… Gitlab
- CVE-2026-76307 HIGH · 7.2 In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer…
- CVE-2026-76303 MEDIUM · 5.7 In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that Splunk SOAR displays in… Splunk
- CVE-2026-76298 HIGH · 8.8 In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar…
- CVE-2026-76293 HIGH · 7.2 In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands…
- CVE-2026-76291 HIGH · 8.8 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards…
- CVE-2026-76287 MEDIUM · 5.4 In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or edit_data_management_pipeline_job capability could read or delete Data Management…
- CVE-2026-114441 HIGH · 7.3 A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full_name/visa_no/hiden/title/description/page_id/user causes…