KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or…
RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism that accepts hex-encoded instructions over UDP port 5005 without proper sanitization. Attackers can send crafted hex-encoded payloads containing system commands to…
Hardkodowane klucze SSH w RUCKUS Network Director umożliwiają nieautoryzowany dostęp do bazy danych.
Hardcodowane dane logowania w Ruckus Network Director umożliwiają zdalny dostęp do bazy danych.
SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior access or…
Skill Scanner is a security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. A vulnerability in the API Server of Skill Scanner could allow a unauthenticated, remote attacker to interact with the…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument Injection.This issue affects Cloud Suite: before 25.2 HF1.
Wstrzyknięcie argumentów w Hyland Alfresco umożliwia zdalne wykonanie kodu przez nieautoryzowanych atakujących.
Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39.4`. Users…
Wstrzyknięcie obiektów PDF w jsPDF umożliwia wykonanie nieautoryzowanego kodu JavaScript.
The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should immediately…
Podatność w SoftVision webPDF umożliwia atakującemu skanowanie portów i włączenie lokalnych plików.
Obejście autoryzacji w Databank Accreditation Software umożliwia wstrzyknięcie SQL.
Brak uwierzytelnienia w BiEticaret CMS umożliwia ominięcie zabezpieczeń i manipulację odpowiedziami HTTP.
An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an…
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10.
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.1.1.
Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute code via simple web requests
A vulnerability was detected in itsourcecode Event Management System 1.0. Affected is an unknown function of the file /admin/manage_booking.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The…
A flaw has been found in itsourcecode Event Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component Admin Login. This manipulation of the argument Username causes sql…
A vulnerability has been found in itsourcecode Event Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_register.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the…
Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via…
The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it…
The Slider Future plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'slider_future_handle_image_upload' function in all versions up to, and including, 1.0.5. This makes it possible for unauthenticated…
The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[template_name]' parameter. This makes it possible for unauthenticated attackers to include and read arbitrary…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-27002 OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host… |
Wysoki priorytet |
CVSS 9,8EPSS 0,53 % | ||
| CVE-2026-27476 RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism that accepts hex-encoded instructions over UDP port 5005 without proper sanitization. Attackers… |
Wysoki priorytet |
CVSS 9,3EPSS 2,99 % | ||
| CVE-2025-67305 Hardkodowane klucze SSH w RUCKUS Network Director umożliwiają nieautoryzowany dostęp do bazy danych. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,57 % | ||
| CVE-2025-67304 Hardcodowane dane logowania w Ruckus Network Director umożliwiają zdalny dostęp do bazy danych. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,56 % | ||
| CVE-2026-27475 SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place… |
Wysoki priorytet |
CVSS 9,2EPSS 0,91 % | ||
| CVE-2026-26057 Skill Scanner is a security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. A vulnerability in the API Server of Skill Scanner… |
Wysoki priorytet |
CVSS 9,1EPSS 0,38 % | ||
| CVE-2026-2409 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument Injection.This issue affects Cloud Suite: before… |
Wysoki priorytet |
CVSS 9,3EPSS 0,25 % | ||
| CVE-2026-26339 Wstrzyknięcie argumentów w Hyland Alfresco umożliwia zdalne wykonanie kodu przez nieautoryzowanych atakujących. |
Wysoki priorytet |
CVSS 9,3EPSS 0,63 % | ||
| CVE-2026-26030 Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter… |
Wysoki priorytet |
CVSS 9,9EPSS 3,91 % | ||
| CVE-2026-25940 Wstrzyknięcie obiektów PDF w jsPDF umożliwia wykonanie nieautoryzowanego kodu JavaScript. |
Wysoki priorytet |
CVSS 9,6EPSS 0,5 % | ||
| CVE-2025-71243 The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this… |
Wysoki priorytet |
CVSS 9,3EPSS 5,6 % | ||
| CVE-2025-55853 Podatność w SoftVision webPDF umożliwia atakującemu skanowanie portów i włączenie lokalnych plików. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,1EPSS 0,43 % | ||
| CVE-2025-9953 Obejście autoryzacji w Databank Accreditation Software umożliwia wstrzyknięcie SQL. |
Wysoki priorytet |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-8350 Brak uwierzytelnienia w BiEticaret CMS umożliwia ominięcie zabezpieczeń i manipulację odpowiedziami HTTP. |
Wysoki priorytet |
CVSS 9,8EPSS 0,62 % | ||
| CVE-2025-15559 An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the… |
Wysoki priorytet |
CVSS 9,8EPSS 0,51 % | ||
| CVE-2026-23542 Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10. |
Wysoki priorytet |
CVSS 9,8EPSS 0,46 % | ||
| CVE-2026-23549 Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.1.1. |
Wysoki priorytet |
CVSS 9,8EPSS 0,45 % | ||
| CVE-2026-2731 Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute code via simple web requests |
Wysoki priorytet |
CVSS 10,0EPSS 0,6 % | ||
| CVE-2026-2689 A vulnerability was detected in itsourcecode Event Management System 1.0. Affected is an unknown function of the file /admin/manage_booking.php. The manipulation of the argument ID results… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,64 % | ||
| CVE-2026-2690 A flaw has been found in itsourcecode Event Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,53 % | ||
| CVE-2026-2691 A vulnerability has been found in itsourcecode Event Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_register.php. Such manipulation… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,47 % | ||
| CVE-2026-25242 Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,68 % | ||
| CVE-2026-1994 The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating… |
Wysoki priorytet |
CVSS 9,8EPSS 0,43 % | ||
| CVE-2026-1405 The Slider Future plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'slider_future_handle_image_upload' function in all versions up… |
Wysoki priorytet |
CVSS 9,8EPSS 3,47 % | ||
| CVE-2026-0926 The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[template_name]' parameter. This makes it… |
Wysoki priorytet |
CVSS 9,8EPSS 9,3 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 10.11.2026, 03:32 UTC – 10.11.2026, 05:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.