KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome,…
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page.
Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to,…
Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.
CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).
Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.
Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.
JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.
Nieautoryzowani zdalni atakujący mogą uzyskać dostęp do systemu przez interfejs zarządzania LoadMaster, co umożliwia wykonanie dowolnych poleceń…
ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.
Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
Wykorzystanie luki w Microsoft Outlook umożliwia zdalne wykonanie kodu.
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.
Przepełnienie bufora w FortiOS umożliwia zdalne wykonanie nieautoryzowanego kodu.
Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage…
Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.
Wstrzyknięcie poleceń w Ivanti Connect Secure umożliwia wykonanie dowolnych komend przez administratora.
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS,…
Brak weryfikacji klucza w ownCloud pozwala na dostęp do plików bez uwierzytelnienia.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| Chromium V8 Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that… |
CISA KEVPubliczny PoC |
CVSS 9,6EPSS 7,47 % | KEVPublikacja CVE | |
| Chromium V8 Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. |
CISA KEVPubliczny PoC |
CVSS 9,6EPSS 15,24 % | KEVPublikacja CVE | |
| Chromium Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple… |
CISA KEV |
CVSS 9,6EPSS 8,35 % | KEVPublikacja CVE | |
| OFBiz Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution. |
CISA KEV |
CVSS 9,8EPSS 99,92 % | KEVPublikacja CVE | |
| CrushFTP CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS). |
CISA KEVPubliczny PoC |
CVSS 10,0EPSS 99,54 % | KEVPublikacja CVE | |
| HugeGraph-Server Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,21 % | KEVPublikacja CVE | |
| PAN-OS Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall. |
CISA KEVPubliczny PoC |
CVSS 10,0EPSS > 99,99 % | KEVPublikacja CVE | |
| Multiple NAS Devices D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 98,04 % | KEVPublikacja CVE | |
| Multiple NAS Devices D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS > 99,99 % | KEVPublikacja CVE | |
| FortiClient EMS Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests. |
CISA KEV |
CVSS 9,8EPSS 98,45 % | KEVPublikacja CVE | |
| TeamCity JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. |
CISA KEV |
CVSS 9,8EPSS 99,94 % | KEVPublikacja CVE | |
| Kemp LoadMaster Nieautoryzowani zdalni atakujący mogą uzyskać dostęp do systemu przez interfejs zarządzania LoadMaster, co umożliwia wykonanie dowolnych poleceń… |
CISA KEV |
CVSS 9,8EPSS 95,39 % | KEVPublikacja CVE | |
| ScreenConnect ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level… |
CISA KEVPubliczny PoC |
CVSS 10,0EPSS 99,98 % | KEVPublikacja CVE | |
| Multiple Products Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via… |
CISA KEV |
CVSS 9,8EPSS 61,72 % | KEVPublikacja CVE | |
| Office Outlook Wykorzystanie luki w Microsoft Outlook umożliwia zdalne wykonanie kodu. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 94,66 % | KEVPublikacja CVE | |
| Exchange Server Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. |
CISA KEV |
CVSS 9,8EPSS 12,56 % | KEVPublikacja CVE | |
| FortiOS Przepełnienie bufora w FortiOS umożliwia zdalne wykonanie nieautoryzowanego kodu. |
CISA KEV |
CVSS 9,8EPSS 84,59 % | KEVPublikacja CVE | |
| Jenkins Command Line Interface (CLI) Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS > 99,99 % | KEVPublikacja CVE | |
| DIR-859 Router D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 82,71 % | KEVPublikacja CVE | |
| Confluence Data Center and Server Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,98 % | KEVPublikacja CVE | |
| Connect Secure and Policy Secure Wstrzyknięcie poleceń w Ivanti Connect Secure umożliwia wykonanie dowolnych komend przez administratora. |
CISA KEVPubliczny PoC |
CVSS 9,1EPSS > 99,99 % | KEVPublikacja CVE | |
| GitLab CE/EE GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 94,65 % | KEVPublikacja CVE | |
| Vision PLC and HMI Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands. |
CISA KEV |
CVSS 9,8EPSS 2,09 % | KEVPublikacja CVE | |
| Chromium Skia Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a… |
CISA KEV |
CVSS 9,6EPSS 16,47 % | KEVPublikacja CVE | |
| ownCloud Brak weryfikacji klucza w ownCloud pozwala na dostęp do plików bez uwierzytelnienia. |
CISA KEV |
CVSS 9,8EPSS 42,92 % | KEVPublikacja CVE |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 23:02 UTC – 13.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.