Alle CVE’s van de afgelopen zes maanden, dagelijks bijgewerkt.

15 van 15 getoond

• HoogCVE-2026-89177CVSS-score 8.811 sep 2026

  WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or perform re

  CWE-757
• GemiddeldCVE-2026-59293CVSS-score 6.627 aug 2026

  Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Spring Integration 7.1.0 Spring Integration 7.0.0 -

  CWE-757vmware spring_integration
• KritiekCVE-2026-72889CVSS-score 9.819 aug 2026

  Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signature_method parameter of the incoming message. signature_method is required on every request, so the

  CWE-347CWE-757
• KritiekCVE-2026-72887CVSS-score 9.816 aug 2026

  Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token. Passing a callback to the constructor selects OAuth 1.0a. get_request_token then revokes that choice when the reques

  CWE-757
• HoogCVE-2026-18691CVSS-score 8.811 aug 2026

  An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the clu

  CWE-757mongodb mongodb
• HoogCVE-2026-55953CVSS-score 7.427 jul 2026

  The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiat

  CWE-757erlang erlang\/otperlang erlang\/ssl
• GemiddeldCVE-2026-4942CVSS-score 5.917 jul 2026

  IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to send a specifically crafted message and downgrade the Transport Layer Security (TLS) protocol to a version disabled in the server configuration.

  CWE-757ibm i
• HoogCVE-2026-53712CVSS-score 8.217 jul 2026

  SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to 3.3, a flaw in com.ongres.scram:scram-client and com.ongres.scram:scram-common all

  CWE-636CWE-757
• GemiddeldCVE-2026-48747CVSS-score 5.314 jul 2026

  Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSignature() parsed X-MOM-Webhook-Signature as algo=signature and passed the request-selected algorithm

  CWE-347CWE-757sensiolabs symfony
• LaagCVE-2026-54780CVSS-score 3.78 jul 2026

  CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, the CoreWCF WS-Security 1.0 receive pipeline validates ds:SignedInfo SignatureMethod against the configured SecurityAlgorithmSuite but does

  CWE-327CWE-757
• GemiddeldCVE-2026-54291CVSS-score 5.96 jul 2026

  pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle prot

  CWE-636CWE-757postgresql postgresql_jdbc_driver
• GemiddeldCVE-2026-6092CVSS-score 5.325 jun 2026

  When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC.

  CWE-757wolfssl wolfssl
• GemiddeldCVE-2026-1677CVSS-score 5.311 mei 2026

  Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS (e.g. via `mbedtls_ssl_conf_min_tls_version`). The Cl

  CWE-757zephyrproject zephyr
• GemiddeldCVE-2026-6550CVSS-score 4.720 apr 2026

  Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, res

  CWE-757
• HoogCVE-2026-32650CVSS-score 7.517 apr 2026

  Anviz CrossChex Standard is vulnerable when an attacker manipulates the TDS7 PreLogin to disable encryption, causing database credentials to be sent in plaintext and enabling unauthorized database access.

  CWE-757anviz crosschex_standard