Alle CVE’s van de afgelopen zes maanden, dagelijks bijgewerkt.

10 van 10 getoond

• GemiddeldCVE-2026-40533CVSS-score 5.318 sep 2026

  An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information.

  CWE-202
• GemiddeldCVE-2026-77883CVSS-score 4.914 sep 2026

  Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User

  CWE-202
• HoogCVE-2026-16520CVSS-score 8.721 aug 2026

  Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V

  CWE-20CWE-202
• HoogCVE-2026-25703CVSS-score 7.35 aug 2026

  NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information.

  CWE-202CWE-306CWE-524
• HoogCVE-2026-70473CVSS-score 8.54 aug 2026

  Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or work

  CWE-200CWE-202CWE-862flowiseai flowise
• GemiddeldCVE-2026-42797CVSS-score 4.925 mei 2026

  Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User

  CWE-202apache syncope
• HoogCVE-2026-40245CVSS-score 7.516 apr 2026

  Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions 4.2.1 and below contain an information disclosure vulnerability in the UDR (Unified Data Repository) service. The handler for GET /nudr-dr/v2/application-

  CWE-200CWE-202CWE-209free5gc free5gc
• HoogCVE-2026-30778CVSS-score 7.515 apr 2026

  The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are recommended to upgrade to version 10.4.0, which fixes the issue.

  CWE-202apache skywalking
• HoogCVE-2026-33530CVSS-score 7.726 mrt 2026

  InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints (e.g. `/api/part

  CWE-202inventree_project inventree
• GemiddeldCVE-2026-3546CVSS-score 5.321 mrt 2026

  The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2. The eshot_form_builder_get_account_data() function is registered as a wp_ajax_ AJAX handler accessible to all authenticate

  CWE-202