KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby Server administration, not at the OS level). Other than network access, no specific preconditions…
Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. An attacker could compile a .dylib file and force the execution of this library in the context of the Sublime Text application.
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard…
A vulnerability was determined in itsourcecode Student Management System 1.0. This affects an unknown part of the file /new_grade.php. This manipulation of the argument grade causes sql injection. The attack can be initiated remotely. The exploit has been…
An issue was discovered in openmptcprouter thru 0.64 in file common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c in function create_xor_ipad_opad allowing attackers to potentially write arbitrary files or execute arbitrary commands.
A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /new_school_year.php. The manipulation of the argument sy leads to sql injection. It is possible to initiate…
A vulnerability was found in itsourcecode Student Management System 1.0. Affected by this issue is some unknown functionality of the file /promote.php. The manipulation of the argument sy results in sql injection. It is possible to launch the attack…
A flaw has been found in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /new_adviser.php. Executing manipulation of the argument Name can lead to sql injection. The attack may be performed from remote. The exploit has…
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Błędna weryfikacja podpisu kryptograficznego w FortiWeb umożliwia ominięcie uwierzytelnienia SSO.
Nieprawidłowa weryfikacja podpisu kryptograficznego w FortiOS umożliwia obejście uwierzytelnienia SSO.
Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the Legacy Remoting Service that is enabled by default. The…
SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other…
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can…
Wykorzystanie WcfProxy w CSLA .NET umożliwia zdalne wykonanie kodu przez podatność w deserializacji.
Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values,…
The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML…
The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization process used by Nokogiri for document transformation, which allows an…
Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high…
Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on…
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could allow an attacker to access and misuse this information, potentially impacting the device’s…
Brak walidacji certyfikatu serwera w IAM w COMOS i NX umożliwia atak typu man-in-the-middle.
Brak walidacji certyfikatu serwera w SALT SDK umożliwia atak typu man-in-the-middle.
Błąd w jądrze Linux umożliwia podwójne usunięcie asocjacji, co może prowadzić do wycieków zasobów.
Błąd use-after-free w komponencie GMP umożliwia zdalne wykonanie kodu.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2025-64113 Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby Server administration, not at… |
Wysoki priorytet |
CVSS 9,8EPSS 0,59 % | ||
| CVE-2025-65741 Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. An attacker could compile a .dylib file and force the execution of this library in the context of the Sublime… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,53 % | ||
| CVE-2025-66456 Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,56 % | ||
| CVE-2025-14337 A vulnerability was determined in itsourcecode Student Management System 1.0. This affects an unknown part of the file /new_grade.php. This manipulation of the argument grade causes sql… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-65882 An issue was discovered in openmptcprouter thru 0.64 in file common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c in function create_xor_ipad_opad allowing attackers to… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,64 % | ||
| CVE-2025-14335 A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /new_school_year.php. The manipulation… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-14336 A vulnerability was found in itsourcecode Student Management System 1.0. Affected by this issue is some unknown functionality of the file /promote.php. The manipulation of the argument sy… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-14334 A flaw has been found in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /new_adviser.php. Executing manipulation of the argument Name can lead to… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-64672 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
Wysoki priorytet |
CVSS 9,0EPSS 1,02 % | ||
| CVE-2025-59719 Błędna weryfikacja podpisu kryptograficznego w FortiWeb umożliwia ominięcie uwierzytelnienia SSO. |
Wysoki priorytet |
CVSS 9,8EPSS 29,22 % | ||
| Multiple Products Nieprawidłowa weryfikacja podpisu kryptograficznego w FortiOS umożliwia obejście uwierzytelnienia SSO. |
CISA KEV |
CVSS 9,8EPSS 68,29 % | KEVPublikacja CVE | |
| CVE-2025-34414 Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting… |
Wysoki priorytet |
CVSS 9,3EPSS 0,96 % | ||
| CVE-2025-63742 SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,41 % | ||
| CVE-2025-67504 WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure,… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,52 % | ||
| CVE-2025-66631 Wykorzystanie WcfProxy w CSLA .NET umożliwia zdalne wykonanie kodu przez podatność w deserializacji. |
Wysoki priorytet |
CVSS 9,8EPSS 0,67 % | ||
| CVE-2025-66565 Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both… |
Wysoki priorytet |
CVSS 9,8EPSS 0,47 % | ||
| CVE-2025-66567 The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an… |
Wysoki priorytet |
CVSS 9,1EPSS 0,42 % | ||
| CVE-2025-66568 The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization… |
Wysoki priorytet |
CVSS 9,1EPSS 0,25 % | ||
| CVE-2025-42928 Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially… |
Wysoki priorytet |
CVSS 9,1EPSS 9,48 % | ||
| CVE-2025-42880 Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the… |
Wysoki priorytet |
CVSS 9,9EPSS 4,5 % | ||
| CVE-2025-40938 A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could allow an attacker to access and… |
Wysoki priorytet |
CVSS 9,8EPSS 0,38 % | ||
| CVE-2025-40800 Brak walidacji certyfikatu serwera w IAM w COMOS i NX umożliwia atak typu man-in-the-middle. |
Wysoki priorytet |
CVSS 9,1EPSS 0,21 % | ||
| CVE-2025-40801 Brak walidacji certyfikatu serwera w SALT SDK umożliwia atak typu man-in-the-middle. |
Wysoki priorytet |
CVSS 9,2EPSS 0,26 % | ||
| CVE-2025-40343 Błąd w jądrze Linux umożliwia podwójne usunięcie asocjacji, co może prowadzić do wycieków zasobów. |
Wysoki priorytet |
CVSS 9,8EPSS 0,65 % | ||
| CVE-2025-14326 Błąd use-after-free w komponencie GMP umożliwia zdalne wykonanie kodu. |
Wysoki priorytet |
CVSS 9,8EPSS 0,46 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 03:02 UTC – 12.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.