KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existing account matched by an IdP-asserted email without checking the account's…
FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.
Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within the application.
idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.
FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers to cause a Denial of Service (DoS) via a crafted input.
An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to…
MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path workspace but ModelSerializer.ModelParams loads and saves a Model by id alone without including workspace_id in the…
Obejście autoryzacji w Envoy pozwala nieautoryzowanym klientom uzyskać dostęp do chronionych zasobów.
NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the `POST /batch-to-vault` endpoint,…
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/fountain.ts passes HTML generated by the vendored fountain.js renderer into note output…
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName from packages/app-desktop/package.json, so the generated app-update.yml causes…
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator…
Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges
W Envoy występuje luka, która pozwala na wykonanie skryptu przez złośliwe nazwy statystyk.
Błąd w Envoy umożliwia nieautoryzowanemu klientowi zdalne zablokowanie procesu.
W Envoy nieautoryzowany klient HTTP/2 może przeprowadzić atak typu response smuggling.
Przepełnienie pamięci w Envoy umożliwia atakującemu zdalne zablokowanie proxy.
Błąd w Envoy umożliwia obejście reguł RBAC, co pozwala na nieautoryzowany dostęp.
Błąd w Envoy umożliwia awarię procesu przez nieprawidłowe przekazywanie danych w HTTP/3.
Błąd w Envoy umożliwia zdalne wywołanie awarii procesu przez nieprawidłowe ramki HTTP/2.
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the import_config handler and the database_file branch of import_database in plexpy/webserve.py join the attacker-controlled config_file.filename or…
luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or…
luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-55210 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existing account… |
Monitoruj |
CVSS 7,4EPSS 0,48 % | ||
| CVE-2026-88409 FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allows attackers to… |
Monitoruj |
CVSS 8,8EPSS 0,48 % | ||
| CVE-2026-88410 The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application. |
Monitoruj |
CVSS 7,1EPSS 0,32 % | ||
| CVE-2026-88411 Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within the application. |
Monitoruj |
CVSS 7,5EPSS 0,49 % | ||
| CVE-2026-88746 idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php. |
Monitoruj |
CVSS 7,1EPSS 0,25 % | ||
| CVE-2026-88406 FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c). This vulnerability allows attackers… |
Monitoruj |
CVSS 7,5EPSS 0,46 % | ||
| CVE-2026-88407 An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers to cause a Denial of Service (DoS) via a crafted… |
Monitoruj |
CVSS 7,5EPSS 0,46 % | ||
| CVE-2026-79316 An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel… |
Monitoruj |
CVSS 7,6EPSS 0,32 % | ||
| CVE-2026-77523 MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path workspace but ModelSerializer.ModelParams loads… |
Monitoruj |
CVSS 7,4EPSS 0,26 % | ||
| CVE-2026-73553 Obejście autoryzacji w Envoy pozwala nieautoryzowanym klientom uzyskać dostęp do chronionych zasobów. |
MonitorujPubliczny PoC |
CVSS 7,5EPSS 0,51 % | ||
| CVE-2026-61647 NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a… |
Monitoruj |
CVSS 7,1EPSS 0,44 % | ||
| CVE-2026-55105 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/fountain.ts passes… |
Monitoruj |
CVSS 7,7EPSS 0,5 % | ||
| CVE-2026-49450 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName from… |
Monitoruj |
CVSS 7,1EPSS 0,18 % | ||
| CVE-2026-49453 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id… |
Monitoruj |
CVSS 7,0EPSS 0,41 % | ||
| CVE-2026-81469 Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit… |
Monitoruj |
CVSS 7,8EPSS 0,19 % | ||
| CVE-2026-73546 W Envoy występuje luka, która pozwala na wykonanie skryptu przez złośliwe nazwy statystyk. |
MonitorujPubliczny PoC |
CVSS 7,4EPSS 0,62 % | ||
| CVE-2026-73547 Błąd w Envoy umożliwia nieautoryzowanemu klientowi zdalne zablokowanie procesu. |
MonitorujPubliczny PoC |
CVSS 7,5EPSS 0,55 % | ||
| CVE-2026-73548 W Envoy nieautoryzowany klient HTTP/2 może przeprowadzić atak typu response smuggling. |
MonitorujPubliczny PoC |
CVSS 7,5EPSS 0,46 % | ||
| CVE-2026-73550 Przepełnienie pamięci w Envoy umożliwia atakującemu zdalne zablokowanie proxy. |
MonitorujPubliczny PoC |
CVSS 7,5EPSS 0,55 % | ||
| CVE-2026-73552 Błąd w Envoy umożliwia obejście reguł RBAC, co pozwala na nieautoryzowany dostęp. |
MonitorujPubliczny PoC |
CVSS 7,5EPSS 0,49 % | ||
| CVE-2026-73512 Błąd w Envoy umożliwia awarię procesu przez nieprawidłowe przekazywanie danych w HTTP/3. |
MonitorujPubliczny PoC |
CVSS 7,5EPSS 0,87 % | ||
| CVE-2026-73513 Błąd w Envoy umożliwia zdalne wywołanie awarii procesu przez nieprawidłowe ramki HTTP/2. |
MonitorujPubliczny PoC |
CVSS 7,5EPSS 0,49 % | ||
| CVE-2026-52835 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the import_config handler and the database_file branch of import_database in… |
Monitoruj |
CVSS 7,0EPSS 0,59 % | ||
| CVE-2026-55159 luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC… |
Monitoruj |
CVSS 8,8EPSS 0,66 % | ||
| CVE-2026-55897 luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations… |
Monitoruj |
CVSS 8,8EPSS 0,65 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 03:02 UTC – 12.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.