KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain…
Wstrzyknięcie poleceń w QNAP umożliwia zdalne wykonanie dowolnych komend.
Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.
Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.
Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.
Netgear JGS516PE devices contain a missing function level access control vulnerability.
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.
Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could…
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.
Błąd uwierzytelniania w SSL VPN FortiOS pozwala na logowanie bez drugiego czynnika autoryzacji.
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.
Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.
Microsoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest operating system. Successful exploitation allows for remote code execution on…
SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.
Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter.
Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that allows for remote code execution.
F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.
DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type…
Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.
Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.
IBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| Chrome FreeType Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images… |
CISA KEVPubliczny PoC |
CVSS 9,6EPSS 63,89 % | KEVPublikacja CVE | |
| Network Attached Storage (NAS) Wstrzyknięcie poleceń w QNAP umożliwia zdalne wykonanie dowolnych komend. |
CISA KEV |
CVSS 9,8EPSS 28,63 % | KEVPublikacja CVE | |
| WebLogic Server Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750. |
CISA KEVPubliczny PoC |
CVSS 10,0EPSS > 99,99 % | KEVPublikacja CVE | |
| WebLogic Server Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability. |
CISA KEV |
CVSS 9,0EPSS 97,93 % | KEVPublikacja CVE | |
| Solaris and Zettabyte File System (ZFS) Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems. |
CISA KEVPubliczny PoC |
CVSS 10,0EPSS 80,16 % | KEVPublikacja CVE | |
| ESXi Błąd use-after-free w OpenSLP w VMware ESXi umożliwia zdalne wykonanie kodu. |
CISA KEV |
CVSS 9,8EPSS 83,02 % | KEVPublikacja CVE | |
| SonicOS A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. |
CISA KEV |
CVSS 9,8EPSS 26,87 % | KEVPublikacja CVE | |
| JGS516PE Devices Netgear JGS516PE devices contain a missing function level access control vulnerability. |
CISA KEV |
CVSS 9,8EPSS 57,47 % | KEVPublikacja CVE | |
| SG UTM A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 96,75 % | KEVPublikacja CVE | |
| File Manager Plugin WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 97,33 % | KEVPublikacja CVE | |
| Netlogon Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain… |
CISA KEVPubliczny PoC |
CVSS 9,3EPSS 99,39 % | KEVPublikacja CVE | |
| Fuel CMS FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 89,69 % | KEVPublikacja CVE | |
| vBulletin The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 87,37 % | KEVPublikacja CVE | |
| FortiOS Błąd uwierzytelniania w SSL VPN FortiOS pozwala na logowanie bez drugiego czynnika autoryzacji. |
CISA KEV |
CVSS 9,8EPSS 45,38 % | KEVPublikacja CVE | |
| WebLogic Server Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit… |
CISA KEV |
CVSS 9,8EPSS 94,55 % | KEVPublikacja CVE | |
| Windows Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also… |
CISA KEV |
CVSS 10,0EPSS 96,72 % | KEVPublikacja CVE | |
| Hyper-V RemoteFX Microsoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest… |
CISA KEV |
CVSS 9,0EPSS 7,39 % | KEVPublikacja CVE | |
| NetWeaver SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and… |
CISA KEV |
CVSS 10,0EPSS 94,72 % | KEVPublikacja CVE | |
| AC1900 Router AC15 Model Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 79,81 % | KEVPublikacja CVE | |
| MobileIron Multiple Products Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that allows for remote code execution. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 99,74 % | KEVPublikacja CVE | |
| BIG-IP F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages. |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS > 99,99 % | KEVPublikacja CVE | |
| Multiple Vigor Routers DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell… |
CISA KEVPubliczny PoC |
CVSS 9,8EPSS 84,48 % | KEVPublikacja CVE | |
| XG Firewall Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature. |
CISA KEV |
CVSS 9,8EPSS 10,67 % | KEVPublikacja CVE | |
| PAN-OS Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication. |
CISA KEV |
CVSS 10,0EPSS 4,36 % | KEVPublikacja CVE | |
| Data Risk Manager IBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a… |
CISA KEV |
CVSS 9,8EPSS 70,03 % | KEVPublikacja CVE |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 03:02 UTC – 13.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.