KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this…
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before…
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation.…
Wbudowany klucz kryptograficzny w Salesforce Marketing Cloud umożliwia manipulację protokołem usług webowych.
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before…
A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 within the gallery/upload.php component. The application fails to properly validate uploaded file contents. Additionally, the application preserves the…
A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available…
An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28. The vulnerability arises because user input is directly inserted into a dynamic SQL query syntax without proper…
Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges.
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.
Podatność w SmarterMail umożliwia zdalne wykonanie kodu bez uwierzytelnienia.
An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof backend responses by exploiting insufficient certificate validation.
An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication. This flaw exists due to a logic issue when determining if the setup phases of the product can be run again. Once an attacker is…
Unified Remote 3.9.0.2463 contains a remote code execution vulnerability that allows attackers to send crafted network packets to execute arbitrary commands. Attackers can exploit the service by connecting to port 9512 and sending specially crafted packets…
An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck() function in file internal/sbi/processor/access_token.go bypasses all scope validation when the attacker uses a crafted targetNF value.…
Obejście uwierzytelnienia w Sufirmam umożliwia nieautoryzowany dostęp do kont.
Niewłaściwe ograniczenie prób uwierzytelnienia w Sufirmam umożliwia atak brute force.
IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing unauthenticated remote attackers to gain administrator privileges by manipulating the web front-end.
IAQS and I6 developed by JNC has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly operate system administrative functionalities.
ALGO 8180 IP Audio Alerter InformaCast Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not…
ALGO 8180 IP Audio Alerter SIP Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit…
ALGO 8180 IP Audio Alerter SAC Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to…
ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices.…
ALGO 8180 IP Audio Alerter SIP INVITE Alert-Info Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices.…
Wykorzystanie exec_globals w Langflow umożliwia zdalne wykonanie dowolnego kodu.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2025-13952 A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shader compiler library. On… |
Wysoki priorytet |
CVSS 9,8EPSS 0,45 % | ||
| CVE-2026-22583 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services… |
Wysoki priorytet |
CVSS 9,8EPSS 0,65 % | ||
| CVE-2026-22585 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center,… |
Wysoki priorytet |
CVSS 9,8EPSS 0,43 % | ||
| CVE-2026-22586 Wbudowany klucz kryptograficzny w Salesforce Marketing Cloud umożliwia manipulację protokołem usług webowych. |
Wysoki priorytet |
CVSS 9,8EPSS 0,6 % | ||
| CVE-2026-22582 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol… |
Wysoki priorytet |
CVSS 9,8EPSS 0,65 % | ||
| CVE-2025-70457 A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 within the gallery/upload.php component. The application fails to properly validate… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,91 % | ||
| CVE-2025-52024 A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an… |
Wysoki priorytet |
CVSS 9,4EPSS 0,45 % | ||
| CVE-2025-52025 An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28. The vulnerability arises because user input is… |
Wysoki priorytet |
CVSS 9,4EPSS 0,36 % | ||
| CVE-2025-70983 Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges. |
Wysoki priorytet |
CVSS 9,9EPSS 0,41 % | ||
| CVE-2025-70985 Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,1EPSS 0,42 % | ||
| SmarterMail Podatność w SmarterMail umożliwia zdalne wykonanie kodu bez uwierzytelnienia. |
CISA KEV |
CVSS 9,8EPSS 88,18 % | KEVPublikacja CVE | |
| CVE-2025-67229 An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof backend responses by exploiting… |
Wysoki priorytet |
CVSS 9,8EPSS 0,27 % | ||
| CVE-2022-25369 An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication. This flaw exists due to a logic issue when determining if the… |
Krytyczne sygnały |
CVSS 9,8EPSS 39,56 % | ||
| CVE-2021-47891 Unified Remote 3.9.0.2463 contains a remote code execution vulnerability that allows attackers to send crafted network packets to execute arbitrary commands. Attackers can exploit the… |
Wysoki priorytet |
CVSS 9,3EPSS 0,95 % | ||
| CVE-2025-66719 An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck() function in file internal/sbi/processor/access_token.go bypasses… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,1EPSS 0,36 % | ||
| CVE-2025-4320 Obejście uwierzytelnienia w Sufirmam umożliwia nieautoryzowany dostęp do kont. |
Wysoki priorytet |
CVSS 10,0EPSS 0,5 % | ||
| CVE-2025-4319 Niewłaściwe ograniczenie prób uwierzytelnienia w Sufirmam umożliwia atak brute force. |
Wysoki priorytet |
CVSS 9,4EPSS 0,4 % | ||
| CVE-2026-1363 IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing unauthenticated remote attackers to gain administrator privileges by manipulating… |
Wysoki priorytet |
CVSS 9,3EPSS 0,59 % | ||
| CVE-2026-1364 IAQS and I6 developed by JNC has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly operate system administrative functionalities. |
Wysoki priorytet |
CVSS 9,3EPSS 0,57 % | ||
| CVE-2026-0793 ALGO 8180 IP Audio Alerter InformaCast Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
Wysoki priorytet |
CVSS 9,8EPSS 0,71 % | ||
| CVE-2026-0794 ALGO 8180 IP Audio Alerter SIP Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO… |
Wysoki priorytet |
CVSS 9,8EPSS 0,71 % | ||
| CVE-2026-0787 ALGO 8180 IP Audio Alerter SAC Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO… |
Wysoki priorytet |
CVSS 9,8EPSS 1,39 % | ||
| CVE-2026-0791 ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
Wysoki priorytet |
CVSS 9,8EPSS 0,88 % | ||
| CVE-2026-0792 ALGO 8180 IP Audio Alerter SIP INVITE Alert-Info Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
Wysoki priorytet |
CVSS 9,8EPSS 0,71 % | ||
| Langflow Wykorzystanie exec_globals w Langflow umożliwia zdalne wykonanie dowolnego kodu. |
CISA KEV |
CVSS 9,8EPSS 62,56 % | KEVPublikacja CVE |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 11.11.2026, 03:32 UTC – 11.11.2026, 05:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.