KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users…
Obejście uwierzytelnienia w CyberPanel umożliwia zdalne wykonanie dowolnych poleceń.
Obejście uwierzytelnienia w CyberPanel pozwala na zdalne wykonanie dowolnych poleceń.
Nieograniczony upload i download plików w Cleo Harmony, VLTrader i LexiCom umożliwia zdalne wykonanie kodu.
Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
Luka w NuPoint Unified Messaging umożliwia atak path traversal i nieautoryzowany dostęp do danych.
ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component.
Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also…
Wykorzystanie use-after-free w Firefox i Thunderbird umożliwia zdalne wykonanie kodu.
Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the…
Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.
Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin…
PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code…
VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.
VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted…
Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.
Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.
Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.
SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data.
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google…
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution.
Błędna implementacja algorytmu uwierzytelniania w Ivanti vTM pozwala na ominięcie uwierzytelnienia panelu admina.
Nieprawidłowe ograniczenie ścieżki w Samsung MagicINFO 9 Server umożliwia atakującym zapis dowolnych plików z uprawnieniami systemowymi.
RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| Multiple Devices Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 28,39 % | KEVPublikacja CVE | |
| CyberPanel Obejście uwierzytelnienia w CyberPanel umożliwia zdalne wykonanie dowolnych poleceń. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 94,75 % | KEVPublikacja CVE | |
| CyberPanel Obejście uwierzytelnienia w CyberPanel pozwala na zdalne wykonanie dowolnych poleceń. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 86,63 % | KEVPublikacja CVE | |
| Multiple Products Nieograniczony upload i download plików w Cleo Harmony, VLTrader i LexiCom umożliwia zdalne wykonanie kodu. |
CISA KEV |
CVSS 9,8EPSS 98,61 % | KEVPublikacja CVE | |
| FortiManager Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 94,77 % | KEVPublikacja CVE | |
| MiCollab Luka w NuPoint Unified Messaging umożliwia atak path traversal i nieautoryzowany dostęp do danych. |
CISA KEV |
CVSS 9,1EPSS 98,11 % | KEVPublikacja CVE | |
| SL1 ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component. |
CISA KEV |
CVSS 9,8EPSS 3,83 % | KEVPublikacja CVE | |
| Expedition Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames,… |
CISA KEVPubliczny PoC |
CVSS 9,1EPSS 99,63 % | KEVPublikacja CVE | |
| Firefox Wykorzystanie use-after-free w Firefox i Thunderbird umożliwia zdalne wykonanie kodu. |
CISA KEV |
CVSS 9,8EPSS 23,18 % | KEVPublikacja CVE | |
| Configuration Manager Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target… |
CISA KEV |
CVSS 9,8EPSS 81,04 % | KEVPublikacja CVE | |
| Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,91 % | KEVPublikacja CVE | |
| Cloud Services Appliance (CSA) Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is… |
CISA KEV |
CVSS 9,1EPSS 98,61 % | KEVPublikacja CVE | |
| PT30X-SDI/NDI Cameras PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI… |
CISA KEVPubliczny PoC |
CVSS 9,1EPSS 58,79 % | KEVPublikacja CVE | |
| vCenter Server VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges… |
CISA KEV |
CVSS 9,8EPSS 17,36 % | KEVPublikacja CVE | |
| vCenter Server VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to… |
CISA KEV |
CVSS 9,8EPSS 54,57 % | KEVPublikacja CVE | |
| Backup & Replication Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 90,37 % | KEVPublikacja CVE | |
| Smart Licensing Utility Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials. |
CISA KEV |
CVSS 9,8EPSS 97,09 % | KEVPublikacja CVE | |
| WhatsUp Gold Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a… |
CISA KEV |
CVSS 9,8EPSS 93 % | KEVPublikacja CVE | |
| SonicOS SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash. |
CISA KEV |
CVSS 9,8EPSS 18,38 % | KEVPublikacja CVE | |
| Web Help Desk SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data. |
CISA KEV |
CVSS 9,1EPSS 93,3 % | KEVPublikacja CVE | |
| Chromium V8 Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web… |
CISA KEVPubliczny PoC |
CVSS 9,6EPSS 21,1 % | KEVPublikacja CVE | |
| Web Help Desk SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution. |
CISA KEV |
CVSS 9,8EPSS 84,63 % | KEVPublikacja CVE | |
| Virtual Traffic Manager Błędna implementacja algorytmu uwierzytelniania w Ivanti vTM pozwala na ominięcie uwierzytelnienia panelu admina. |
CISA KEV |
CVSS 9,8EPSS > 99,99 % | KEVPublikacja CVE | |
| MagicINFO 9 Server Nieprawidłowe ograniczenie ścieżki w Samsung MagicINFO 9 Server umożliwia atakującym zapis dowolnych plików z uprawnieniami systemowymi. |
CISA KEV |
CVSS 9,8EPSS 91,94 % | KEVPublikacja CVE | |
| Webmail RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that… |
CISA KEV |
CVSS 9,3EPSS 82,88 % | KEVPublikacja CVE |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 19:02 UTC – 13.11.2026, 00:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.