KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.0, a vulnerability exists in FreeRDP’s certificate handling code on Windows platforms. The function `freerdp_certificate_data_hash_ uses` the Microsoft-specific…
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. An incomplete configuration (agent authentication) in DriveLock tenant allows attackers to impersonate any DriveLock agent on the network against the DES…
A vulnerability was identified in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /updateproduct.php?action=edit. Such manipulation of the argument ID leads to sql injection. It is possible to launch the…
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This…
RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS…
Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to missing sanitization of inputs in ldap search query. The vulnerability could…
Błąd w Safari pozwala na nieautoryzowany dostęp do Web API w trybie Lockdown.
Błąd konfiguracyjny w systemach Apple pozwala na przeglądanie ukrytych zdjęć bez uwierzytelnienia.
An issue was discovered in 25.1.2 before 25.1.5. A Cross Site Scripting (XSS) issue in DriveLock Operations Center allows for session takeover over a network.
A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (field `serviceName`)…
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate privileged processes to gain more privileges on Windows computers.
AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for managing gallery images fail to enforce authentication checks and do not validate ownership,…
ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation…
An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.
An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file.
Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an…
An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.
Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI).
Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and not officially…
ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform…
An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.
An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to leaking heap data. An attacker can provide a malicious file to trigger this vulnerability.
An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The…
An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The…
Przepełnienie bufora w Meltytech Shotcut umożliwia naruszenie dostępu do pamięci.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2025-68118 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.0, a vulnerability exists in FreeRDP’s certificate handling code on Windows platforms. The function… |
Wysoki priorytet |
CVSS 9,1EPSS 0,24 % | ||
| CVE-2025-67791 An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. An incomplete configuration (agent authentication) in DriveLock tenant allows… |
Wysoki priorytet |
CVSS 9,8EPSS 0,37 % | ||
| CVE-2025-14832 A vulnerability was identified in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /updateproduct.php?action=edit. Such manipulation of… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-67793 An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or… |
Wysoki priorytet |
CVSS 9,8EPSS 0,32 % | ||
| CVE-2025-66647 RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,97 % | ||
| CVE-2025-67493 Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to missing… |
Wysoki priorytet |
CVSS 9,0EPSS 0,3 % | ||
| CVE-2025-43526 Błąd w Safari pozwala na nieautoryzowany dostęp do Web API w trybie Lockdown. |
Wysoki priorytet |
CVSS 9,8EPSS 0,53 % | ||
| CVE-2025-43428 Błąd konfiguracyjny w systemach Apple pozwala na przeglądanie ukrytych zdjęć bez uwierzytelnienia. |
Wysoki priorytet |
CVSS 9,8EPSS 0,71 % | ||
| CVE-2025-67787 An issue was discovered in 25.1.2 before 25.1.5. A Cross Site Scripting (XSS) issue in DriveLock Operations Center allows for session takeover over a network. |
Wysoki priorytet |
CVSS 9,6EPSS 0,26 % | ||
| CVE-2025-67073 A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,69 % | ||
| CVE-2025-67781 An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate privileged processes to gain more privileges on… |
Wysoki priorytet |
CVSS 9,9EPSS 0,28 % | ||
| CVE-2025-34434 AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for managing gallery images fail… |
Wysoki priorytet |
CVSS 9,1EPSS 0,47 % | ||
| CVE-2025-62521 ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 4,51 % | ||
| CVE-2025-67165 An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,5 % | ||
| CVE-2025-67164 An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,9EPSS 0,53 % | ||
| Multiple Products Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary… |
CISA KEV |
CVSS 10,0EPSS 32,39 % | KEVPublikacja CVE | |
| CVE-2025-44005 An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks. |
Wysoki priorytet |
CVSS 10,0EPSS 9,09 % | ||
| CVE-2022-23851 Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI). |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,5 % | ||
| CVE-2025-67895 Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2. The Edge3 provider… |
Wysoki priorytet |
CVSS 9,8EPSS 1,17 % | ||
| Live Update ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds… |
CISA KEV |
CVSS 9,8EPSS 1,2 % | KEVPublikacja CVE | |
| CVE-2025-14700 An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side… |
Wysoki priorytet |
CVSS 9,9EPSS 6,56 % | ||
| CVE-2025-48429 An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to leaking heap data. An… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,1EPSS 0,43 % | ||
| CVE-2025-53618 An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An… |
Wysoki priorytet |
CVSS 9,1EPSS 0,32 % | ||
| CVE-2025-53619 An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An… |
Wysoki priorytet |
CVSS 9,1EPSS 0,34 % | ||
| CVE-2025-65834 Przepełnienie bufora w Meltytech Shotcut umożliwia naruszenie dostępu do pamięci. |
Wysoki priorytet |
CVSS 9,8EPSS 0,41 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 11.11.2026, 23:02 UTC – 12.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.