KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
Wykorzystanie podatności w SysAid umożliwia zdalne wykonanie kodu przez atakującego.
Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any…
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to…
F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port…
NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request.
VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution.
Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the…
Nieznana podatność w Confluence Data Center i Server pozwala na tworzenie nieautoryzowanych kont administratora.
JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.
Błąd w VPN Cisco ASA umożliwia atakującemu zdalne przeprowadzenie ataku brute force na hasła.
Luka w tunelowaniu żądań HTTP w Qlik Sense umożliwia zdalne podniesienie uprawnień.
Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable…
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application.
Obejście uwierzytelnienia w Ivanti EPMM umożliwia nieautoryzowany dostęp do zasobów aplikacji.
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
Zdalne wykonanie kodu bez uwierzytelnienia w aplikacji.
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.
Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling…
Przepełnienie bufora w FortiOS umożliwia zdalne wykonanie dowolnego kodu.
VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| Sense Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software. |
CISA KEV |
CVSS 9,9EPSS 47,45 % | KEVPublikacja CVE | |
| SysAid Server Wykorzystanie podatności w SysAid umożliwia zdalne wykonanie kodu przez atakującego. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 98,85 % | KEVPublikacja CVE | |
| Confluence Data Center and Server Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS > 99,99 % | KEVPublikacja CVE | |
| ActiveMQ Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,89 % | KEVPublikacja CVE | |
| BIG-IP Configuration Utility F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 96,52 % | KEVPublikacja CVE | |
| Mirth Connect NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 82,71 % | KEVPublikacja CVE | |
| vCenter Server VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,43 % | KEVPublikacja CVE | |
| IOS XE Web UI Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15… |
CISA KEV |
CVSS 10,0EPSS 99,57 % | KEVPublikacja CVE | |
| Confluence Data Center and Server Nieznana podatność w Confluence Data Center i Server pozwala na tworzenie nieautoryzowanych kont administratora. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,22 % | KEVPublikacja CVE | |
| TeamCity JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,99 % | KEVPublikacja CVE | |
| Adaptive Security Appliance and Firepower Threat Defense Błąd w VPN Cisco ASA umożliwia atakującemu zdalne przeprowadzenie ataku brute force na hasła. |
CISA KEV |
CVSS 9,1EPSS 25,45 % | KEVPublikacja CVE | |
| Sense Luka w tunelowaniu żądań HTTP w Qlik Sense umożliwia zdalne podniesienie uprawnień. |
CISA KEV |
CVSS 9,9EPSS 88,22 % | KEVPublikacja CVE | |
| Sentry Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,95 % | KEVPublikacja CVE | |
| Junos OS Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 95,07 % | KEVPublikacja CVE | |
| Endpoint Manager Mobile (EPMM) and MobileIron Core Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of… |
CISA KEV |
CVSS 9,8EPSS > 99,99 % | KEVPublikacja CVE | |
| Endpoint Manager Mobile (EPMM) Obejście uwierzytelnienia w Ivanti EPMM umożliwia nieautoryzowany dostęp do zasobów aplikacji. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS > 99,99 % | KEVPublikacja CVE | |
| ColdFusion Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. |
CISA KEV |
CVSS 9,8EPSS 97,07 % | KEVPublikacja CVE | |
| NetScaler ADC and NetScaler Gateway Zdalne wykonanie kodu bez uwierzytelnienia w aplikacji. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,75 % | KEVPublikacja CVE | |
| ColdFusion Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. |
CISA KEV |
CVSS 9,8EPSS 99,99 % | KEVPublikacja CVE | |
| Content Collaboration Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones… |
CISA KEV |
CVSS 9,8EPSS 97,34 % | KEVPublikacja CVE | |
| Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to… |
CISA KEV |
CVSS 9,0EPSS 77,27 % | KEVPublikacja CVE | |
| Multiple Network-Attached Storage (NAS) Devices Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely… |
CISA KEV |
CVSS 9,8EPSS 82,83 % | KEVPublikacja CVE | |
| SharePoint Server Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for… |
CISA KEV |
CVSS 9,8EPSS 99,98 % | KEVPublikacja CVE | |
| FortiOS and FortiProxy SSL-VPN Przepełnienie bufora w FortiOS umożliwia zdalne wykonanie dowolnego kodu. |
CISA KEV |
CVSS 9,8EPSS 85,69 % | KEVPublikacja CVE | |
| Aria Operations for Networks VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 98,28 % | KEVPublikacja CVE |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 23:02 UTC – 13.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.