KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparatio…
Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.
Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.
Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.
Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions.
Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.
Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.
Administrator SQL Injection in WP Maps <= 4.9.9 versions.
Administrator SQL Injection in Newsletters <= 4.18 versions.
Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving…
admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as…
admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured…
Luka w Dell OpenManage Server Administrator umożliwia zdalny dostęp do systemu plików.
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a…
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel…
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode() in objects/functions.php derives the code entirely from…
AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the…
Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the default), the Clockwork profiler endpoint is exposed without authentication:…
Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string): GravExtension::assertSandboxDumpSafe() determines sandbox state by…
Przepełnienie bufora w Dell OpenManage Server Administrator umożliwia zdalne wykonanie kodu.
Przepełnienie bufora w Dell OpenManage Server Administrator umożliwia zdalne wykonanie kodu.
Przepełnienie bufora w Dell OpenManage umożliwia eskalację uprawnień lokalnemu atakującemu.
Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are executed as multi-statement queries. An attacker who is able to supply a malicious project…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-80218 Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different… |
Monitoruj |
CVSS 7,6EPSS 0,64 % | ||
| CVE-2026-66631 Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions. |
Monitoruj |
CVSS 7,6EPSS 0,38 % | ||
| CVE-2026-66625 Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions. |
Monitoruj |
CVSS 7,6EPSS 0,38 % | ||
| CVE-2026-66626 Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions. |
Monitoruj |
CVSS 7,6EPSS 0,38 % | ||
| CVE-2026-66628 Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions. |
Monitoruj |
CVSS 7,6EPSS 0,38 % | ||
| CVE-2026-66630 Administrator SQL Injection in PublishPress Series <= 3.1.3 versions. |
Monitoruj |
CVSS 7,6EPSS 0,38 % | ||
| CVE-2026-66624 Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions. |
Monitoruj |
CVSS 7,6EPSS 0,38 % | ||
| CVE-2026-66618 Administrator SQL Injection in WP Maps <= 4.9.9 versions. |
Monitoruj |
CVSS 7,6EPSS 0,38 % | ||
| CVE-2026-66619 Administrator SQL Injection in Newsletters <= 4.18 versions. |
Monitoruj |
CVSS 7,6EPSS 0,38 % | ||
| CVE-2026-66580 Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions. |
Monitoruj |
CVSS 8,5EPSS 0,36 % | ||
| CVE-2026-66571 Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions. |
Monitoruj |
CVSS 7,1EPSS 0,13 % | ||
| CVE-2026-14850 The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric… |
Monitoruj |
CVSS 8,8EPSS 0,41 % | ||
| CVE-2026-92918 admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from… |
Monitoruj |
CVSS 8,8EPSS 0,65 % | ||
| CVE-2026-92919 admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments.… |
Monitoruj |
CVSS 7,2EPSS 0,58 % | ||
| CVE-2026-81481 Luka w Dell OpenManage Server Administrator umożliwia zdalny dostęp do systemu plików. |
Monitoruj |
CVSS 7,5EPSS 0,53 % | ||
| CVE-2026-92925 A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for… |
Monitoruj |
CVSS 7,1EPSS 0,71 % | ||
| CVE-2026-92912 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one… |
Monitoruj |
CVSS 8,3EPSS 0,31 % | ||
| CVE-2026-92913 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes.… |
Monitoruj |
CVSS 7,4EPSS 0,53 % | ||
| CVE-2026-92914 AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized… |
Monitoruj |
CVSS 8,6EPSS 0,48 % | ||
| CVE-2026-92916 Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the default), the Clockwork… |
Monitoruj |
CVSS 8,7EPSS 0,5 % | ||
| CVE-2026-92917 Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode,… |
Monitoruj |
CVSS 8,7EPSS 0,46 % | ||
| CVE-2026-81480 Przepełnienie bufora w Dell OpenManage Server Administrator umożliwia zdalne wykonanie kodu. |
Monitoruj |
CVSS 7,2EPSS 0,62 % | ||
| CVE-2026-81477 Przepełnienie bufora w Dell OpenManage Server Administrator umożliwia zdalne wykonanie kodu. |
Monitoruj |
CVSS 7,2EPSS 0,62 % | ||
| CVE-2026-81474 Przepełnienie bufora w Dell OpenManage umożliwia eskalację uprawnień lokalnemu atakującemu. |
Monitoruj |
CVSS 7,8EPSS 0,15 % | ||
| CVE-2026-92903 Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are executed as multi-statement… |
Monitoruj |
CVSS 8,2EPSS 0,19 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 9.11.2026, 23:32 UTC – 10.11.2026, 01:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.