KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command…
The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for…
SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with…
SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that…
A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed from remote.…
A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possible to be carried out…
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents…
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address…
Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and…
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one…
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression…
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only…
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is…
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/src/mqtt/mqtt.rs permits repeated PUBREC or PUBREL messages to be appended to one…
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service…
Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file…
SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode…
The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to…
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer…
Błąd autoryzacji w IBM Guardium Data Protection umożliwia zdalnemu atakującemu obejście zabezpieczeń.
Wykorzystanie podatności CSRF w IBM Guardium Data Protection umożliwia ominięcie zabezpieczeń.
Nieprawidłowe neutralizowanie elementów w IBM Guardium Data Protection umożliwia zdalne wykonanie poleceń OS.
Nieprawidłowe ograniczenie ścieżki w IBM Guardium Data Protection umożliwia zdalne wykonanie kodu.
Nieprawidłowe zarządzanie uprawnieniami w IBM Guardium Data Protection umożliwia lokalnemu atakującemu eskalację uprawnień.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-87909 The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the… |
Monitoruj |
CVSS 7,5EPSS 0,91 % | ||
| CVE-2026-13354 The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to… |
Monitoruj |
CVSS 7,2EPSS 0,42 % | ||
| CVE-2026-93922 SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can… |
Monitoruj |
CVSS 8,6EPSS 0,82 % | ||
| CVE-2026-93923 SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or… |
Monitoruj |
CVSS 8,6EPSS 0,6 % | ||
| CVE-2026-93739 A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the argument submit-url… |
Monitoruj |
CVSS 8,6EPSS 0,85 % | ||
| CVE-2026-93738 A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the argument webpage… |
Monitoruj |
CVSS 8,6EPSS 0,85 % | ||
| CVE-2026-88097 Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally. |
Monitoruj |
CVSS 7,8EPSS 0,26 % | ||
| CVE-2026-71418 Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in… |
Monitoruj |
CVSS 7,5EPSS 0,62 % | ||
| CVE-2026-71855 Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6… |
Monitoruj |
CVSS 7,5EPSS 0,31 % | ||
| CVE-2026-68928 Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in… |
Monitoruj |
CVSS 8,6EPSS 0,2 % | ||
| CVE-2026-63448 Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed… |
Monitoruj |
CVSS 7,5EPSS 0,45 % | ||
| CVE-2026-63452 Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work… |
Monitoruj |
CVSS 7,5EPSS 0,63 % | ||
| CVE-2026-63446 Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in… |
Monitoruj |
CVSS 7,5EPSS 0,68 % | ||
| CVE-2026-63447 Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can… |
Monitoruj |
CVSS 7,5EPSS 0,63 % | ||
| CVE-2026-57227 Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in… |
Monitoruj |
CVSS 7,5EPSS 0,7 % | ||
| CVE-2026-57223 Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and… |
Monitoruj |
CVSS 7,0EPSS 0,15 % | ||
| CVE-2026-93872 Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write permissions… |
Monitoruj |
CVSS 7,7EPSS 0,71 % | ||
| CVE-2026-93838 SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode… |
Monitoruj |
CVSS 8,2EPSS 0,65 % | ||
| CVE-2026-93031 The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and… |
Monitoruj |
CVSS 8,8EPSS 0,58 % | ||
| CVE-2026-92708 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions… |
Monitoruj |
CVSS 7,5EPSS 0,73 % | ||
| CVE-2026-84241 Błąd autoryzacji w IBM Guardium Data Protection umożliwia zdalnemu atakującemu obejście zabezpieczeń. |
Monitoruj |
CVSS 8,1EPSS 0,45 % | ||
| CVE-2026-84084 Wykorzystanie podatności CSRF w IBM Guardium Data Protection umożliwia ominięcie zabezpieczeń. |
Monitoruj |
CVSS 8,8EPSS 0,24 % | ||
| CVE-2026-84085 Nieprawidłowe neutralizowanie elementów w IBM Guardium Data Protection umożliwia zdalne wykonanie poleceń OS. |
Monitoruj |
CVSS 8,1EPSS 0,5 % | ||
| CVE-2026-84086 Nieprawidłowe ograniczenie ścieżki w IBM Guardium Data Protection umożliwia zdalne wykonanie kodu. |
Monitoruj |
CVSS 7,2EPSS 0,87 % | ||
| CVE-2026-84089 Nieprawidłowe zarządzanie uprawnieniami w IBM Guardium Data Protection umożliwia lokalnemu atakującemu eskalację uprawnień. |
Monitoruj |
CVSS 7,8EPSS 0,14 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 07:02 UTC – 12.11.2026, 12:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.