Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
Computing the effects of a TLB invalidation involves looking at
the size of the mapping cached by the TLB. For S1 mappings such as
VNCR, this is deducted…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(),…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection.
This issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listdom allows Blind SQL Injection.
This issue affects Listdom: from n/a through 5.4.0.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback.
Apple posts the user's name to the callback…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
CVSS
9,3
EPSS
0,22 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
Computing the effects of a TLB invalidation involves looking at
the size of the mapping cached by the TLB. For S1 mappings such as
VNCR, this is deducted…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(),…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection.
This issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listdom allows Blind SQL Injection.
This issue affects Listdom: from n/a through 5.4.0.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback.
Apple posts the user's name to the callback…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
9,3
0,22 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.