KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target…
A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack…
Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. The application generates a new 'sessionId' each time a user authenticates, but does not invalidate…
The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address.
Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.
IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or perform unauthorized actions due to the use of hard coded user credentials.
Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be…
Błąd w Rocket TRUfusion Enterprise umożliwia atakującym zapis plików w dowolnej lokalizacji, co może prowadzić do zdalnego wykonania kodu.
Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authentication to the underlying Linux system. Multiple local user accounts, including accounts with administrative…
A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via injecting crafted Freemarker template syntax into the SQL script field.
A vulnerability has been found in Beetel 777VR1 up to 01.00.09. The impacted element is an unknown function of the component Web Management Interface. The manipulation leads to hard-coded credentials. The attack needs to be initiated within the local…
Wykorzystanie niezabezpieczonego interpretera Lua w OpenS100 pozwala na zdalne wykonanie kodu.
Brak uwierzytelnienia w LightLLM umożliwia zdalne wykonanie kodu przez atakującego.
Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defaults to using the uuidgen command to generate a UUID, with a fallback to using Perl's built-in rand…
Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to the built-in rand() function, and the PID.
A security flaw has been discovered in Intelbras VIP 3260 Z IA 2.840.00IB005.0.T. Affected by this vulnerability is an unknown functionality of the file /OutsideCmd. The manipulation results in weak password recovery. It is possible to launch the attack…
The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge…
Wykorzystanie luki w DeepAudit umożliwia zdalne wykonanie ataku typu server-side request forgery.
Wstrzyknięcie poleceń w Wavlink WL-WN579A3 umożliwia zdalne wykonanie kodu.
Wstrzyknięcie poleceń w Wavlink WL-WN579A3 umożliwia zdalne wykonanie kodu.
Wstrzyknięcie poleceń w Wavlink WL-WN579A3 umożliwia zdalne wykonanie kodu.
Korupcja pamięci w Open5GS umożliwia zdalne wykonanie ataku.
Korupcja pamięci w Open5GS umożliwia zdalne ataki.
Domyślne dane logowania w eNet SMART HOME umożliwiają nieautoryzowany dostęp do konfiguracji.
The Infotainment ECU manufactured by Bosch uses a RH850 module for CAN communication. RH850 is connected to infotainment over the INC interface through a custom protocol. There is a vulnerability during processing requests of this protocol on the V850 side…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-2329 An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve… |
Krytyczne sygnały |
CVSS 9,8EPSS 41,72 % | ||
| CVE-2026-2654 A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,43 % | ||
| CVE-2026-1435 Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. The application generates a… |
Wysoki priorytet |
CVSS 9,8EPSS 0,42 % | ||
| CVE-2026-1670 The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address. |
Wysoki priorytet |
CVSS 9,3EPSS 0,84 % | ||
| RecoverPoint for Virtual Machines (RP4VMs) Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to… |
CISA KEV |
CVSS 10,0EPSS 13,53 % | KEVPublikacja CVE | |
| CVE-2025-33089 IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or perform unauthorized actions due to the use of hard coded user credentials. |
Wysoki priorytet |
CVSS 9,8EPSS 0,26 % | ||
| CVE-2025-66614 Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following… |
Wysoki priorytet |
CVSS 9,1EPSS 0,27 % | ||
| CVE-2025-59793 Błąd w Rocket TRUfusion Enterprise umożliwia atakującym zapis plików w dowolnej lokalizacji, co może prowadzić do zdalnego wykonania kodu. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,4EPSS 1,13 % | ||
| CVE-2026-23647 Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authentication to the underlying Linux system.… |
Wysoki priorytet |
CVSS 9,3EPSS 0,66 % | ||
| CVE-2025-70830 A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via injecting crafted… |
Wysoki priorytet |
CVSS 9,9EPSS 1,1 % | ||
| CVE-2026-2616 A vulnerability has been found in Beetel 777VR1 up to 01.00.09. The impacted element is an unknown function of the component Web Management Interface. The manipulation leads to hard-coded… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 1,22 % | ||
| CVE-2026-22208 Wykorzystanie niezabezpieczonego interpretera Lua w OpenS100 pozwala na zdalne wykonanie kodu. |
Wysoki priorytet |
CVSS 9,4EPSS 1,08 % | ||
| CVE-2026-26220 Brak uwierzytelnienia w LightLLM umożliwia zdalne wykonanie kodu przez atakującego. |
Wysoki priorytet |
CVSS 9,3EPSS 0,96 % | ||
| CVE-2026-2439 Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defaults to using the uuidgen… |
Wysoki priorytet |
CVSS 9,8EPSS 0,47 % | ||
| CVE-2025-15578 Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to… |
Wysoki priorytet |
CVSS 9,8EPSS 0,32 % | ||
| CVE-2026-2564 A security flaw has been discovered in Intelbras VIP 3260 Z IA 2.840.00IB005.0.T. Affected by this vulnerability is an unknown functionality of the file /OutsideCmd. The manipulation… |
Wysoki priorytet |
CVSS 9,2EPSS 0,54 % | ||
| CVE-2026-2577 The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming… |
Wysoki priorytet |
CVSS 10,0EPSS 0,66 % | ||
| CVE-2026-2532 Wykorzystanie luki w DeepAudit umożliwia zdalne wykonanie ataku typu server-side request forgery. |
Wysoki priorytet |
CVSS 9,8EPSS 0,29 % | ||
| CVE-2026-2529 Wstrzyknięcie poleceń w Wavlink WL-WN579A3 umożliwia zdalne wykonanie kodu. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 9,45 % | ||
| CVE-2026-2527 Wstrzyknięcie poleceń w Wavlink WL-WN579A3 umożliwia zdalne wykonanie kodu. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 9,45 % | ||
| CVE-2026-2528 Wstrzyknięcie poleceń w Wavlink WL-WN579A3 umożliwia zdalne wykonanie kodu. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 9,19 % | ||
| CVE-2026-2522 Korupcja pamięci w Open5GS umożliwia zdalne wykonanie ataku. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,64 % | ||
| CVE-2026-2521 Korupcja pamięci w Open5GS umożliwia zdalne ataki. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,76 % | ||
| CVE-2026-26366 Domyślne dane logowania w eNet SMART HOME umożliwiają nieautoryzowany dostęp do konfiguracji. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,3EPSS 0,72 % | ||
| CVE-2025-32058 The Infotainment ECU manufactured by Bosch uses a RH850 module for CAN communication. RH850 is connected to infotainment over the INC interface through a custom protocol. There is a… |
Wysoki priorytet |
CVSS 9,3EPSS 0,17 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 10.11.2026, 07:32 UTC – 10.11.2026, 09:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.