KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
A flaw has been found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formArpBindConfig. Executing manipulation of the argument pools can lead to buffer overflow. The attack may be performed from remote. The…
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to…
Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands.
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject…
Krytyczna podatność w TUUI umożliwia zdalne wykonanie dowolnych poleceń na maszynie ofiary poprzez złośliwe wiadomości Markdown.
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain…
ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands as the web server user. Attackers can upload PHP executable files via the Quick File Uploader page,…
A vulnerability was detected in Edimax BR-6478AC V3 1.0.15. Impacted is the function sub_416990 of the file /boafrm/formTracerouteDiagnosticRun. The manipulation of the argument host results in os command injection. The attack can be launched remotely. The…
A flaw has been found in Edimax BR-6478AC V3 1.0.15. The affected element is the function sub_44CCE4 of the file /boafrm/formSysCmd. This manipulation of the argument sysCmd causes os command injection. The attack may be initiated remotely. The exploit has…
A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafted POST request to the /cgi-bin/webconfig?page=upload&action=submit endpoint.
The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.44. This is due to the plugin not…
The CRM Memberships plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 2.6. This is due to missing authorization and authentication checks on the `ntzcrm_changepassword` AJAX action. This makes…
LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be…
Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution.
UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject…
Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain circumstances. This issue affects CareLink Network: before December 4, 2025.
Przechowywanie twardo zakodowanych poświadczeń w libicos.so w ALLNET ALL-RUT22GW umożliwia nieautoryzowany dostęp.
Wstrzyknięcie poleceń w ALLNET ALL-RUT22GW umożliwia zdalne wykonanie kodu.
Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to set the Administrator password and username as blank values, allowing attackers to bypass authentication.
A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file /goform/aspForm. This manipulation of the argument param causes buffer overflow. Remote exploitation of the attack is possible. The exploit…
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers…
Błąd w jądrze Linuxa w nvme-fc może prowadzić do uszkodzenia listy i awarii systemu.
Wyścig w mptcp_pm_del_add_timer() w jądrze Linux prowadzi do użycia po zwolnieniu pamięci.
Wyścig warunków w mptcp_schedule_work() w jądrze Linux prowadzi do użycia po zwolnieniu.
Błąd w pętli w qede_tpa_cont() i qede_tpa_end() w jądrze Linux może prowadzić do odczytu poza granicami tablicy.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2025-14141 A flaw has been found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formArpBindConfig. Executing manipulation of the argument pools can lead… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,81 % | ||
| CVE-2025-12673 The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in all versions up to, and… |
Wysoki priorytet |
CVSS 9,8EPSS 0,73 % | ||
| ArrayOS AG Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands. |
CISA KEV |
CVSS 9,8EPSS 3,42 % | KEVPublikacja CVE | |
| CVE-2025-66570 cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,34 % | ||
| CVE-2025-66562 Krytyczna podatność w TUUI umożliwia zdalne wykonanie dowolnych poleceń na maszynie ofiary poprzez złośliwe wiadomości Markdown. |
Wysoki priorytet |
CVSS 9,6EPSS 0,52 % | ||
| CVE-2025-34256 Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across… |
Wysoki priorytet |
CVSS 9,8EPSS 0,69 % | ||
| CVE-2020-36877 ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands as the web server user.… |
Wysoki priorytet |
CVSS 9,3EPSS 0,72 % | ||
| CVE-2025-14093 A vulnerability was detected in Edimax BR-6478AC V3 1.0.15. Impacted is the function sub_416990 of the file /boafrm/formTracerouteDiagnosticRun. The manipulation of the argument host… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 19,57 % | ||
| CVE-2025-14094 A flaw has been found in Edimax BR-6478AC V3 1.0.15. The affected element is the function sub_44CCE4 of the file /boafrm/formSysCmd. This manipulation of the argument sysCmd causes os… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 20,32 % | ||
| CVE-2025-64054 A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafted POST… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,6EPSS 0,44 % | ||
| CVE-2025-12374 The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all… |
Wysoki priorytet |
CVSS 9,8EPSS 0,5 % | ||
| CVE-2025-13313 The CRM Memberships plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 2.6. This is due to missing authorization and… |
Wysoki priorytet |
CVSS 9,8EPSS 0,55 % | ||
| CVE-2025-66509 LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the… |
Wysoki priorytet |
CVSS 9,8EPSS 0,44 % | ||
| CVE-2025-66576 Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 1,34 % | ||
| CVE-2025-66571 UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without… |
Wysoki priorytet |
CVSS 9,3EPSS 0,66 % | ||
| CVE-2025-12995 Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain… |
Wysoki priorytet |
CVSS 9,8EPSS 0,36 % | ||
| CVE-2025-29268 Przechowywanie twardo zakodowanych poświadczeń w libicos.so w ALLNET ALL-RUT22GW umożliwia nieautoryzowany dostęp. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 9,08 % | ||
| CVE-2025-29269 Wstrzyknięcie poleceń w ALLNET ALL-RUT22GW umożliwia zdalne wykonanie kodu. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 1,98 % | ||
| CVE-2025-63362 Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to set the Administrator password and… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,61 % | ||
| CVE-2025-14015 A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file /goform/aspForm. This manipulation of the argument param causes buffer… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,88 % | ||
| CVE-2025-66516 Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External… |
Krytyczne sygnały |
CVSS 9,8EPSS 89,02 % | ||
| CVE-2025-40261 Błąd w jądrze Linuxa w nvme-fc może prowadzić do uszkodzenia listy i awarii systemu. |
Wysoki priorytet |
CVSS 9,8EPSS 0,6 % | ||
| CVE-2025-40257 Wyścig w mptcp_pm_del_add_timer() w jądrze Linux prowadzi do użycia po zwolnieniu pamięci. |
Wysoki priorytet |
CVSS 9,8EPSS 0,5 % | ||
| CVE-2025-40258 Wyścig warunków w mptcp_schedule_work() w jądrze Linux prowadzi do użycia po zwolnieniu. |
Wysoki priorytet |
CVSS 9,8EPSS 0,5 % | ||
| CVE-2025-40252 Błąd w pętli w qede_tpa_cont() i qede_tpa_end() w jądrze Linux może prowadzić do odczytu poza granicami tablicy. |
Wysoki priorytet |
CVSS 9,8EPSS 0,65 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 07:02 UTC – 12.11.2026, 12:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.