KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which…
The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.
Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design…
Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.
Wtyczka vCenter Server w kliencie vSphere (HTML5) umożliwia zdalne wykonanie kodu.
Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.
Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.
Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.
Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution.
Wstrzyknięcie SQL w SonicWall SSLVPN SMA100 umożliwia dostęp do danych użytkowników.
QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.
D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.
D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution.
Przechodzenie katalogów w ONLYOFFICE Document Server umożliwia zdalne wykonanie kodu.
Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().
Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.
SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands.
Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.
Wstrzyknięcie SQL w WebAdmin Cyberoam OS umożliwia zdalne wykonanie dowolnych poleceń SQL.
Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the…
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.
Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| iOS, iPadOS, and macOS Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit,… |
CISA KEV |
CVSS 9,8EPSS 7 % | KEVPublikacja CVE | |
| BIG-IP Traffic Management Microkernel The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls. |
CISA KEV |
CVSS 9,8EPSS 61,06 % | KEVPublikacja CVE | |
| BIG-IP and BIG-IQ Centralized Management F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,9 % | KEVPublikacja CVE | |
| Multiple Products Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify… |
CISA KEV |
CVSS 9,8EPSS 63,63 % | KEVPublikacja CVE | |
| Backup Exec Agent Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 64,91 % | KEVPublikacja CVE | |
| vCenter Server Wtyczka vCenter Server w kliencie vSphere (HTML5) umożliwia zdalne wykonanie kodu. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,87 % | KEVPublikacja CVE | |
| FTA Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html. |
CISA KEV |
CVSS 9,8EPSS 6 % | KEVPublikacja CVE | |
| FTA Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html. |
CISA KEV |
CVSS 9,8EPSS 11,41 % | KEVPublikacja CVE | |
| FTA Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints. |
CISA KEV |
CVSS 9,8EPSS 56,69 % | KEVPublikacja CVE | |
| Operation Bridge Reporter (OBR) Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 96,74 % | KEVPublikacja CVE | |
| SSLVPN SMA100 Wstrzyknięcie SQL w SonicWall SSLVPN SMA100 umożliwia dostęp do danych użytkowników. |
CISA KEV |
CVSS 9,8EPSS 40,04 % | KEVPublikacja CVE | |
| Helpdesk QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information. |
CISA KEV |
CVSS 9,8EPSS 1,98 % | KEVPublikacja CVE | |
| DNS-320 Device D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,97 % | KEVPublikacja CVE | |
| DIR-825 R1 Devices D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 54,32 % | KEVPublikacja CVE | |
| Docs Przechodzenie katalogów w ONLYOFFICE Document Server umożliwia zdalne wykonanie kodu. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 14,55 % | KEVPublikacja CVE | |
| Ignition Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,94 % | KEVPublikacja CVE | |
| Chrome Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML… |
CISA KEV |
CVSS 9,6EPSS 2,73 % | KEVPublikacja CVE | |
| Orion SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands. |
CISA KEV |
CVSS 9,8EPSS 91,98 % | KEVPublikacja CVE | |
| Multiple Products Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 90,16 % | KEVPublikacja CVE | |
| CyberoamOS Wstrzyknięcie SQL w WebAdmin Cyberoam OS umożliwia zdalne wykonanie dowolnych poleceń SQL. |
CISA KEV |
CVSS 9,8EPSS 4,7 % | KEVPublikacja CVE | |
| Struts Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution. |
CISA KEV |
CVSS 9,8EPSS 95,93 % | KEVPublikacja CVE | |
| Multiple Products VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the… |
CISA KEV |
CVSS 9,1EPSS 17,3 % | KEVPublikacja CVE | |
| Airflow's Experimental API The previous default setting for Airflow's Experimental API was to allow all API requests without authentication. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,78 % | KEVPublikacja CVE | |
| Salt SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,59 % | KEVPublikacja CVE | |
| Chrome for Android UI Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape… |
CISA KEV |
CVSS 9,6EPSS 6,36 % | KEVPublikacja CVE |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 03:02 UTC – 13.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.