KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing predictable MD5-based cookies. Attackers who know or guess valid…
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative access to the management interface. Attackers can authenticate using the hardcoded default…
Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the hosting_id parameter. Attackers can send GET requests to the rooms/ajax_refresh_subtotal endpoint with…
Obejście uwierzytelnienia w aplikacji NestJS z Fastify umożliwia dostęp bez autoryzacji.
Nieprawidłowa walidacja danych w Centreon Open Tickets pozwala na nieautoryzowany dostęp.
Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central Server…
Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated attacker to bypass authentication and gain administrative privileges. This issue was identified in version 1.2.0 of this…
Wstrzyknięcie SQL w Windesk.Fm umożliwia nieautoryzowany dostęp do bazy danych.
W PluXml CMS atakujący może przejąć sesję użytkownika przez ustalenie identyfikatora sesji przed uwierzytelnieniem.
Wstrzyknięcie SQL w platformie e-commerce Dayneks umożliwia nieautoryzowany dostęp do danych.
Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full…
Twardo zakodowane dane logowania w Frick Controls Quantum HD umożliwiają nieautoryzowany dostęp.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit unexpected…
Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security…
Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security…
Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit…
Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to RCE. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please…
An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of the encrypted SSH communication, if they are able to intercept or interact with the network traffic.
The Listee theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.6. This is due to a broken validation check in the bundled listee-core plugin's user registration function that fails to properly sanitize the…
A security flaw has been discovered in youlaitech youlai-mall 2.0.0. This affects the function listPagedSpuForApp of the file mall-pms/pms-boot/src/main/java/com/youlai/mall/pms/controller/app/SpuController.java of the component App-side Product Pagination…
A weakness has been identified in Sanluan PublicCMS 6.202506.d. This impacts the function saveMetadata of the file TemplateCacheComponent.java of the component Template Cache Generation. Executing a manipulation can lead to path traversal. The attack can be…
In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized…
Przepełnienie bufora w ThinkWise umożliwia zdalne włączenie kodu, co może prowadzić do przejęcia kontroli nad systemem.
Przepełnienie bufora w XWEB Pro umożliwia nieautoryzowanym atakującym awarię programu.
An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, and potentially causing a denial-of-service attack.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-27755 SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing… |
Wysoki priorytet |
CVSS 9,3EPSS 0,46 % | ||
| CVE-2026-27751 SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative access to the management… |
Wysoki priorytet |
CVSS 9,3EPSS 0,51 % | ||
| CVE-2019-25489 Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the hosting_id parameter. Attackers… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,1EPSS 0,45 % | ||
| CVE-2026-2293 Obejście uwierzytelnienia w aplikacji NestJS z Fastify umożliwia dostęp bez autoryzacji. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,76 % | ||
| CVE-2026-2750 Nieprawidłowa walidacja danych w Centreon Open Tickets pozwala na nieautoryzowany dostęp. |
Wysoki priorytet |
CVSS 9,8EPSS 0,34 % | ||
| CVE-2026-2751 Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows… |
Wysoki priorytet |
CVSS 9,8EPSS 0,31 % | ||
| CVE-2025-15498 Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated attacker to bypass authentication and gain… |
Wysoki priorytet |
CVSS 9,3EPSS 0,59 % | ||
| CVE-2025-11252 Wstrzyknięcie SQL w Windesk.Fm umożliwia nieautoryzowany dostęp do bazy danych. |
Wysoki priorytet |
CVSS 9,8EPSS 0,43 % | ||
| CVE-2026-24352 W PluXml CMS atakujący może przejąć sesję użytkownika przez ustalenie identyfikatora sesji przed uwierzytelnieniem. |
Krytyczne sygnałyCERT.pl |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-11251 Wstrzyknięcie SQL w platformie e-commerce Dayneks umożliwia nieautoryzowany dostęp do danych. |
Wysoki priorytet |
CVSS 9,8EPSS 0,44 % | ||
| CVE-2026-21659 Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated… |
Wysoki priorytet |
CVSS 9,8EPSS 1,05 % | ||
| CVE-2026-21660 Twardo zakodowane dane logowania w Frick Controls Quantum HD umożliwiają nieautoryzowany dostęp. |
Wysoki priorytet |
CVSS 9,8EPSS 0,26 % | ||
| CVE-2026-21654 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command… |
Wysoki priorytet |
CVSS 9,8EPSS 1,66 % | ||
| CVE-2026-21656 Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain… |
Wysoki priorytet |
CVSS 9,8EPSS 0,45 % | ||
| CVE-2026-21657 Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain… |
Wysoki priorytet |
CVSS 9,8EPSS 0,45 % | ||
| CVE-2026-21658 Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection.… |
Wysoki priorytet |
CVSS 9,8EPSS 0,71 % | ||
| CVE-2026-2251 Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to RCE. This issue affects… |
Wysoki priorytet |
CVSS 9,8EPSS 0,45 % | ||
| CVE-2026-1626 An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of the encrypted SSH communication, if they are able… |
Wysoki priorytet |
CVSS 9,1EPSS 0,24 % | ||
| CVE-2025-12981 The Listee theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.6. This is due to a broken validation check in the bundled listee-core… |
Wysoki priorytet |
CVSS 9,8EPSS 0,63 % | ||
| CVE-2026-3287 A security flaw has been discovered in youlaitech youlai-mall 2.0.0. This affects the function listPagedSpuForApp of the file mall-pms/pms-boot/src/main/java/com/youlai/mall/pms/controller/… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,43 % | ||
| CVE-2026-3289 A weakness has been identified in Sanluan PublicCMS 6.202506.d. This impacts the function saveMetadata of the file TemplateCacheComponent.java of the component Template Cache Generation.… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,76 % | ||
| CVE-2026-28370 In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,1EPSS 0,85 % | ||
| CVE-2026-24497 Przepełnienie bufora w ThinkWise umożliwia zdalne włączenie kodu, co może prowadzić do przejęcia kontroli nad systemem. |
Wysoki priorytet |
CVSS 9,8EPSS 0,37 % | ||
| CVE-2026-20797 Przepełnienie bufora w XWEB Pro umożliwia nieautoryzowanym atakującym awarię programu. |
Wysoki priorytet |
CVSS 9,8EPSS 0,83 % | ||
| CVE-2026-22877 An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, and potentially causing a… |
Wysoki priorytet |
CVSS 9,1EPSS 0,61 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 9.11.2026, 19:02 UTC – 9.11.2026, 20:32 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.