Alle CVE’s van de afgelopen zes maanden, dagelijks bijgewerkt.

5 van 5 getoond

• KritiekCVE-2026-85724CVSS-score 9.623 sep 2026

  Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an

  CWE-155CWE-863
• HoogCVE-2026-87016CVSS-score 8.19 sep 2026

  Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE s

  CWE-155CWE-287openwebui open_webui
• LaagCVE-2026-68939CVSS-score 2.018 aug 2026

  Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in libexec/pyenv-version-name, libexec/pyenv

  CWE-78CWE-88CWE-155
• GemiddeldCVE-2026-73412CVSS-score 6.312 aug 2026

  Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options E

  CWE-78CWE-155
• GemiddeldCVE-2026-49482CVSS-score 4.312 jun 2026

  ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user can send a % character as the number par

  CWE-155CWE-943