KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
A heap-based buffer overflow vulnerability exists in the Intan CLP parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted Intan CLP file can lead to arbitrary code execution. An attacker can provide a…
A buffer overflow vulnerability was discovered in goform/formSetMacFilterCfg in Tenda AC15V1.0 V15.03.05.18_multi.
renren-secuity before v5.5.0 is vulnerable to SQL Injection in the BaseServiceImpl.java component
An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) component
Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue.
Domyślne dane logowania w OpenMQ umożliwiają zdalne przejęcie kontroli przez atakującego.
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to improper privilege management in all versions up to, and including, 5.1.2.…
The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.2.5. This makes it possible for unauthenticated attackers to bypass authentication and log in as…
code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/cancel-order.php.
code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket-admin.php.
code-projects Simple Gym Management System v1.0 is vulnerable to SQL Injection in /gym/trainer_search.php.
code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/edit-orders.php.
code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket.php.
In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a path traversal error. This could lead to local denial of service with no additional execution…
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_category.php.
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_product.php.
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_receipt.php.
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_supplier.php.
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php.
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php.
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However,…
An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd.
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user.php.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-22891 A heap-based buffer overflow vulnerability exists in the Intan CLP parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted Intan CLP… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,68 % | ||
| CVE-2026-24103 A buffer overflow vulnerability was discovered in goform/formSetMacFilterCfg in Tenda AC15V1.0 V15.03.05.18_multi. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,48 % | ||
| CVE-2025-70821 renren-secuity before v5.5.0 is vulnerable to SQL Injection in the BaseServiceImpl.java component |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,46 % | ||
| CVE-2025-57622 An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) component |
Wysoki priorytet |
CVSS 9,8EPSS 0,58 % | ||
| CVE-2025-59059 Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue. |
Wysoki priorytet |
CVSS 9,8EPSS 1,38 % | ||
| CVE-2026-22886 Domyślne dane logowania w OpenMQ umożliwiają zdalne przejęcie kontroli przez atakującego. |
Wysoki priorytet |
CVSS 9,8EPSS 0,46 % | ||
| CVE-2026-1492 The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to… |
Wysoki priorytet |
CVSS 9,8EPSS 28,89 % | ||
| CVE-2026-2628 The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.2.5. This makes it possible… |
Wysoki priorytet |
CVSS 9,8EPSS 0,97 % | ||
| CVE-2026-26713 code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/cancel-order.php. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,38 % | ||
| CVE-2026-26712 code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket-admin.php. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,37 % | ||
| CVE-2026-26709 code-projects Simple Gym Management System v1.0 is vulnerable to SQL Injection in /gym/trainer_search.php. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,37 % | ||
| CVE-2026-26710 code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/edit-orders.php. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,38 % | ||
| CVE-2026-26711 code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket.php. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,37 % | ||
| CVE-2026-0006 In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges… |
Wysoki priorytet |
CVSS 9,8EPSS 0,64 % | ||
| CVE-2025-48645 In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. This could lead to local escalation of privilege with no additional… |
Wysoki priorytet |
CVSS 9,8EPSS 0,21 % | ||
| CVE-2025-48609 In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a path traversal error. This… |
Wysoki priorytet |
CVSS 9,1EPSS 0,28 % | ||
| CVE-2026-26704 sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_category.php. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,46 % | ||
| CVE-2026-26705 sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_product.php. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,46 % | ||
| CVE-2026-26706 sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_receipt.php. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,53 % | ||
| CVE-2026-26707 sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_supplier.php. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,53 % | ||
| CVE-2026-26700 sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,44 % | ||
| CVE-2026-26708 sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,37 % | ||
| CVE-2026-28286 ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,9EPSS 0,47 % | ||
| CVE-2026-24105 An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leading to a command injection vulnerability if… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 1,98 % | ||
| CVE-2026-26701 sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user.php. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,53 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 9.11.2026, 15:32 UTC – 9.11.2026, 17:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.