KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An attacker can supply crafted input that is executed as part of backend database queries. The issue…
Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. The application does not adequately restrict uploaded file types, allowing malicious files to be uploaded and executed…
Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default configurations, this flaw can be leveraged to achieve remote code execution.
The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. This makes it possible for unauthenticated…
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.
SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality.
Wstrzyknięcie poleceń w Dokploy umożliwia zdalne wykonanie kodu na serwerze.
SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Function`…
W Clatter występuje luka w zgodności protokołu, co może prowadzić do osłabienia bezpieczeństwa kluczy.
Wykorzystanie podatności Zip Slip w RAGFlow pozwala na zdalne wykonanie kodu przez nadpisanie plików.
Luka w Dozzle pozwala na uzyskanie interaktywnego dostępu do kontenerów poza zakresem.
An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypass authentication and take administrative control of the device. This issue affects Session Smart…
Obejście uwierzytelnienia w Fortinet FortiAnalyzer umożliwia dostęp do obcych urządzeń.
A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain conditions. This may impact the confidentiality, integrity, or availability of the system.
Przepełnienie bufora w GnuPG umożliwia zdalne wykonanie kodu lub atak typu denial of service.
Suricata is a network IDS, IPS and NSM engine. While saving a dataset a stack buffer is used to prepare the data. Prior to versions 8.0.3 and 7.0.14, if the data in the dataset is too large, this can result in a stack overflow. Versions 8.0.3 and 7.0.14…
Suricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead to a heap use-after-free condition when generating excessive amounts of alerts for a single packet. Versions 8.0.3 and 7.0.14 contain a…
Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have a critical authorization boundary bypass in namespaced Kyverno Policy apiCall. The resolved `urlPath` is executed using the Kyverno…
code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExAddNewUser.php via the Name, Address, email, UserName, Password, confirm_password, Role, Branch, and Activate parameters.
code-projects Computer Book Store 1.0 is vulnerable to File Upload in admin_add.php.
code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /insertmessage.php via the userid parameter.
code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExLogin.php via the Password parameter.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2025-57792 Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An attacker can supply crafted… |
Wysoki priorytet |
CVSS 10,0EPSS 0,44 % | ||
| CVE-2025-57794 Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. The application does not adequately restrict… |
Wysoki priorytet |
CVSS 9,1EPSS 0,64 % | ||
| CVE-2025-57795 Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default configurations, this flaw can be leveraged to… |
Wysoki priorytet |
CVSS 9,9EPSS 0,63 % | ||
| CVE-2026-1056 The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to,… |
Wysoki priorytet |
CVSS 9,8EPSS 13,28 % | ||
| Web Help Desk SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host… |
CISA KEV |
CVSS 9,8EPSS 84,18 % | KEVPublikacja CVE | |
| CVE-2025-40552 SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should… |
Krytyczne sygnały |
CVSS 9,8EPSS 52 % | ||
| CVE-2025-40553 SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run… |
Krytyczne sygnały |
CVSS 9,8EPSS 67,98 % | ||
| CVE-2025-40554 SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk. |
Krytyczne sygnały |
CVSS 9,8EPSS 60,64 % | ||
| Web Help Desk SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality. |
CISA KEV |
CVSS 9,8EPSS 73,56 % | KEVPublikacja CVE | |
| CVE-2026-24841 Wstrzyknięcie poleceń w Dokploy umożliwia zdalne wykonanie kodu na serwerze. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,9EPSS 2,79 % | ||
| CVE-2026-23830 SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library… |
Krytyczne sygnałyPubliczny PoC |
CVSS 10,0EPSS 1,22 % | ||
| CVE-2026-24785 W Clatter występuje luka w zgodności protokołu, co może prowadzić do osłabienia bezpieczeństwa kluczy. |
Wysoki priorytet |
CVSS 9,1EPSS 0,14 % | ||
| CVE-2026-24770 Wykorzystanie podatności Zip Slip w RAGFlow pozwala na zdalne wykonanie kodu przez nadpisanie plików. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 1,43 % | ||
| CVE-2026-24740 Luka w Dozzle pozwala na uzyskanie interaktywnego dostępu do kontenerów poza zakresem. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,9EPSS 0,42 % | ||
| CVE-2025-21589 An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypass authentication and take… |
Wysoki priorytet |
CVSS 9,3EPSS 1,55 % | ||
| Multiple Products Obejście uwierzytelnienia w Fortinet FortiAnalyzer umożliwia dostęp do obcych urządzeń. |
CISA KEV |
CVSS 9,8EPSS 86,59 % | KEVPublikacja CVE | |
| CVE-2025-14988 A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain conditions. This may impact the confidentiality, integrity, or… |
Wysoki priorytet |
CVSS 10,0EPSS 0,45 % | ||
| CVE-2026-24881 Przepełnienie bufora w GnuPG umożliwia zdalne wykonanie kodu lub atak typu denial of service. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 1,81 % | ||
| CVE-2026-22262 Suricata is a network IDS, IPS and NSM engine. While saving a dataset a stack buffer is used to prepare the data. Prior to versions 8.0.3 and 7.0.14, if the data in the dataset is too… |
Wysoki priorytet |
CVSS 9,8EPSS 0,56 % | ||
| CVE-2026-22264 Suricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead to a heap use-after-free condition when generating excessive amounts… |
Wysoki priorytet |
CVSS 9,1EPSS 0,41 % | ||
| CVE-2026-22039 Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have a critical authorization boundary bypass in namespaced Kyverno… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,9EPSS 0,58 % | ||
| CVE-2025-69564 code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExAddNewUser.php via the Name, Address, email, UserName, Password, confirm_password, Role, Branch, and… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,48 % | ||
| CVE-2025-69559 code-projects Computer Book Store 1.0 is vulnerable to File Upload in admin_add.php. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,6 % | ||
| CVE-2025-69562 code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /insertmessage.php via the userid parameter. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,53 % | ||
| CVE-2025-69563 code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExLogin.php via the Password parameter. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,53 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 10.11.2026, 23:32 UTC – 11.11.2026, 01:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.