KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the device.
TG8 Firewall contains a pre-authentication remote code execution vulnerability in the runphpcmd.php endpoint. The syscmd POST parameter is passed directly to a system command without validation and executed with root privileges. A remote, unauthenticated…
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploitable remotely for Escalation of Privileges.
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploitable remotely for Escalation of Privileges.
Zanieczyszczenie prototypu w pakiecie npm expr-eval umożliwia zdalne wykonanie kodu.
Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
Wstrzyknięcie SQL w Simple Online Hotel Reservation System umożliwia zdalne wykonanie ataku.
Wstrzyknięcie SQL w Simple Online Hotel Reservation System umożliwia zdalne wykonanie ataku.
A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This manipulation of the argument search_term causes sql injection. Remote exploitation of the attack is…
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was…
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on…
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a…
Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery (SSRF) vulnerability in the Typebot webhook block (HTTP Request component) functionality allows authenticated users to make arbitrary HTTP requests from the…
A flaw has been found in AMTT Hotel Broadband Operation System 1.0. The impacted element is an unknown function of the file /user/portal/get_firstdate.php. Executing manipulation of the argument uid can lead to sql injection. It is possible to launch the…
Wstrzyknięcie SQL w SourceCodester Patients Waiting Area umożliwia zdalne ataki.
ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing users…
Nieskuteczna złożoność wyrażeń regularnych w Zoom Workplace Clients umożliwia eskalację uprawnień.
Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.
pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the…
An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized access into the affected system. Refer to the 'Security Update for DSL Series Router' section on the ASUS Security…
Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server.…
Luka w Oracle Identity Manager pozwala nieautoryzowanemu atakującemu na przejęcie systemu.
Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2025-58083 General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the device. |
Wysoki priorytet |
CVSS 9,2EPSS 0,6 % | ||
| CVE-2021-4470 TG8 Firewall contains a pre-authentication remote code execution vulnerability in the runphpcmd.php endpoint. The syscmd POST parameter is passed directly to a system command without… |
Wysoki priorytet |
CVSS 9,3EPSS 0,84 % | ||
| CVE-2025-54339 An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploitable remotely for Escalation of Privileges. |
Wysoki priorytet |
CVSS 10,0EPSS 0,33 % | ||
| CVE-2025-54343 An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploitable remotely for Escalation of Privileges. |
Wysoki priorytet |
CVSS 9,6EPSS 0,28 % | ||
| CVE-2025-13204 Zanieczyszczenie prototypu w pakiecie npm expr-eval umożliwia zdalne wykonanie kodu. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,85 % | ||
| FortiWeb Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 91,08 % | KEVPublikacja CVE | |
| CVE-2025-13169 Wstrzyknięcie SQL w Simple Online Hotel Reservation System umożliwia zdalne wykonanie ataku. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,48 % | ||
| CVE-2025-13170 Wstrzyknięcie SQL w Simple Online Hotel Reservation System umożliwia zdalne wykonanie ataku. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,42 % | ||
| CVE-2025-13168 A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This manipulation of the argument… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,4 % | ||
| CVE-2025-36251 IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This… |
Wysoki priorytet |
CVSS 9,8EPSS 0,54 % | ||
| CVE-2025-36236 IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker… |
Wysoki priorytet |
CVSS 9,1EPSS 0,53 % | ||
| CVE-2025-36250 IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary commands due to improper… |
Wysoki priorytet |
CVSS 9,8EPSS 0,67 % | ||
| CVE-2025-64709 Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery (SSRF) vulnerability in the Typebot webhook block (HTTP Request component)… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,9EPSS 0,4 % | ||
| CVE-2025-13123 A flaw has been found in AMTT Hotel Broadband Operation System 1.0. The impacted element is an unknown function of the file /user/portal/get_firstdate.php. Executing manipulation of the… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,37 % | ||
| CVE-2025-13122 Wstrzyknięcie SQL w SourceCodester Patients Waiting Area umożliwia zdalne ataki. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,47 % | ||
| CVE-2025-64717 ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL's federation process allowed… |
Wysoki priorytet |
CVSS 9,8EPSS 0,5 % | ||
| CVE-2025-62484 Nieskuteczna złożoność wyrażeń regularnych w Zoom Workplace Clients umożliwia eskalację uprawnień. |
Wysoki priorytet |
CVSS 9,8EPSS 0,32 % | ||
| CVE-2025-64741 Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access. |
Wysoki priorytet |
CVSS 9,8EPSS 0,44 % | ||
| CVE-2025-12762 pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This… |
Wysoki priorytet |
CVSS 9,8EPSS 12,71 % | ||
| CVE-2025-59367 An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized access into the affected system. Refer to the… |
Wysoki priorytet |
CVSS 9,8EPSS 0,86 % | ||
| Triofox Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete. |
CISA KEVPubliczny PoC |
CVSS 9,1EPSS 95,75 % | KEVPublikacja CVE | |
| CLI React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 93,98 % | KEVPublikacja CVE | |
| Fusion Middleware Luka w Oracle Identity Manager pozwala nieautoryzowanemu atakującemu na przejęcie systemu. |
CISA KEV |
CVSS 9,8EPSS 88,65 % | KEVPublikacja CVE | |
| LANSCOPE Endpoint Manager Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially… |
CISA KEV |
CVSS 9,3EPSS 2,77 % | KEVPublikacja CVE | |
| BIG-IP Luka w BIG-IP APM umożliwia zdalne wykonanie kodu przez złośliwy ruch. |
CISA KEV |
CVSS 9,3EPSS 2,3 % | KEVPublikacja CVE |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 15:02 UTC – 12.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.