KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL),…
Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as…
Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code…
Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code…
Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to…
PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS,…
Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.
Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.
Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization.
Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.
D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.
Wykonanie kodu zdalnego w Array Networks AG Series umożliwia przeglądanie systemu plików bez uwierzytelnienia.
Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.
IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.
Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This…
Wielokrotne produkty Zoho ManageEngine umożliwiają zdalne wykonanie kodu przez lukę w Apache Santuario.
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
Błąd w WebGPU IPC w Firefoxie umożliwia eskalację uprawnień przez wykorzystanie use-after-free.
Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| MOVEit Transfer Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,93 % | KEVPublikacja CVE | |
| Email Security Gateway (ESG) Appliance Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection. |
CISA KEV |
CVSS 9,8EPSS 87,69 % | KEVPublikacja CVE | |
| RocketMQ Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 96,57 % | KEVPublikacja CVE | |
| Multiple Firewalls Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated… |
CISA KEV |
CVSS 9,8EPSS 28,14 % | KEVPublikacja CVE | |
| Multiple Firewalls Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated… |
CISA KEV |
CVSS 9,8EPSS 29,02 % | KEVPublikacja CVE | |
| Multiple Firewalls Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,28 % | KEVPublikacja CVE | |
| Superset Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 97,41 % | KEVPublikacja CVE | |
| MF/NG PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS > 99,99 % | KEVPublikacja CVE | |
| Chromium Skia Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a… |
CISA KEV |
CVSS 9,6EPSS 5,74 % | KEVPublikacja CVE | |
| Novi Survey Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account. |
CISA KEV |
CVSS 9,8EPSS 2,69 % | KEVPublikacja CVE | |
| Web Appliance Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS > 99,99 % | KEVPublikacja CVE | |
| Pentaho Business Analytics (BA) Server Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 92,27 % | KEVPublikacja CVE | |
| Cobalt Strike Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution. |
CISA KEV |
CVSS 9,8EPSS 2,71 % | KEVPublikacja CVE | |
| ColdFusion Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user. |
CISA KEV |
CVSS 9,8EPSS 16,99 % | KEVPublikacja CVE | |
| ColdFusion Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 97,34 % | KEVPublikacja CVE | |
| DIR-820 Router D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 97,86 % | KEVPublikacja CVE | |
| AG/vxAG ArrayOS Wykonanie kodu zdalnego w Array Networks AG Series umożliwia przeglądanie systemu plików bez uwierzytelnienia. |
CISA KEV |
CVSS 9,8EPSS 68,08 % | KEVPublikacja CVE | |
| Office Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user. |
CISA KEV |
CVSS 9,8EPSS 97,16 % | KEVPublikacja CVE | |
| Aspera Faspex IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw. |
CISA KEV |
CVSS 9,8EPSS 99,97 % | KEVPublikacja CVE | |
| Multiple Products Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 98,07 % | KEVPublikacja CVE | |
| ManageEngine Wielokrotne produkty Zoho ManageEngine umożliwiają zdalne wykonanie kodu przez lukę w Apache Santuario. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,75 % | KEVPublikacja CVE | |
| Control Web Panel CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS > 99,99 % | KEVPublikacja CVE | |
| FortiOS Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,47 % | KEVPublikacja CVE | |
| Firefox Błąd w WebGPU IPC w Firefoxie umożliwia eskalację uprawnień przez wykorzystanie use-after-free. |
CISA KEVPubliczny PoC |
CVSS 9,6EPSS 2,35 % | KEVPublikacja CVE | |
| Application Delivery Controller (ADC) and Gateway Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to… |
CISA KEV |
CVSS 9,8EPSS 6,68 % | KEVPublikacja CVE |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 23:02 UTC – 13.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.