KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.
Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords.
Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.
ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely.
ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.
Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL,…
OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via…
Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.
Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading…
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users…
Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
Wstrzyknięcie szablonu w Rejetto HTTP File Server umożliwia zdalne wykonanie poleceń.
Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome,…
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page.
Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to,…
Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.
CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).
Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.
Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.
JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| OFBiz Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated… |
CISA KEV |
CVSS 9,8EPSS 99,43 % | KEVPublikacja CVE | |
| Cyber Infrastructure (ACI) Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords. |
CISA KEV |
CVSS 9,8EPSS 53,25 % | KEVPublikacja CVE | |
| Expedition Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 91,68 % | KEVPublikacja CVE | |
| Utah, Vancouver, and Washington DC Now Platform ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability… |
CISA KEV |
CVSS 9,8EPSS 99,98 % | KEVPublikacja CVE | |
| Utah, Vancouver, and Washington DC Now Platform ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user… |
CISA KEV |
CVSS 9,8EPSS 99,63 % | KEVPublikacja CVE | |
| HTTP Server Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the… |
CISA KEV |
CVSS 9,1EPSS 99,96 % | KEVPublikacja CVE | |
| GeoServer OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,81 % | KEVPublikacja CVE | |
| WhatsUp Gold Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution. |
CISA KEV |
CVSS 9,8EPSS 99,29 % | KEVPublikacja CVE | |
| VMware vCenter Server Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter… |
CISA KEV |
CVSS 9,8EPSS 22,38 % | KEVPublikacja CVE | |
| Multiple Devices Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 10,07 % | KEVPublikacja CVE | |
| Commerce and Magento Open Source Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,99 % | KEVPublikacja CVE | |
| PHP PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,99 % | KEVPublikacja CVE | |
| HTTP File Server Wstrzyknięcie szablonu w Rejetto HTTP File Server umożliwia zdalne wykonanie poleceń. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,49 % | KEVPublikacja CVE | |
| Telerik Report Server Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access. |
CISA KEV |
CVSS 9,8EPSS 97,48 % | KEVPublikacja CVE | |
| Chromium V8 Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that… |
CISA KEVPubliczny PoC |
CVSS 9,6EPSS 7,47 % | KEVPublikacja CVE | |
| Chromium V8 Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. |
CISA KEVPubliczny PoC |
CVSS 9,6EPSS 15,24 % | KEVPublikacja CVE | |
| Chromium Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple… |
CISA KEV |
CVSS 9,6EPSS 8,35 % | KEVPublikacja CVE | |
| OFBiz Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution. |
CISA KEV |
CVSS 9,8EPSS 99,92 % | KEVPublikacja CVE | |
| CrushFTP CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS). |
CISA KEVPubliczny PoC |
CVSS 10,0EPSS 99,54 % | KEVPublikacja CVE | |
| HugeGraph-Server Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,21 % | KEVPublikacja CVE | |
| PAN-OS Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall. |
CISA KEVPubliczny PoC |
CVSS 10,0EPSS > 99,99 % | KEVPublikacja CVE | |
| Multiple NAS Devices D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 98,04 % | KEVPublikacja CVE | |
| Multiple NAS Devices D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS > 99,99 % | KEVPublikacja CVE | |
| FortiClient EMS Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests. |
CISA KEV |
CVSS 9,8EPSS 98,45 % | KEVPublikacja CVE | |
| TeamCity JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. |
CISA KEV |
CVSS 9,8EPSS 99,94 % | KEVPublikacja CVE |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 19:02 UTC – 13.11.2026, 00:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.