Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services,…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute
local file path.
This issue was fixed in version V4.
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POST /completion request emitting a…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system.
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services,…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute
local file path.
This issue was fixed in version V4.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POST /completion request emitting a…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,42 % · rekomendacja wg zapisanej polityki