Dotkliwość: Wysoka
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| microservices-platform | CVE-2026-92469 zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/{id} endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and… |
7,2 | 0,54 % | Brak wpisu w KEV nie wyklucza ataków | |
| Jenkins Warnings Plugin | CVE-2026-92134 Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site… |
8,0 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków | |
| Jenkins Coverage Plugin | CVE-2026-92135 Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting… |
8,0 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków | |
| Jenkins OWASP Dependency-Check Plugin | CVE-2026-92136 Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
8,0 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków | |
| Jenkins Robot Framework Plugin | CVE-2026-92137 Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to create or replace arbitrary files on the… |
8,8 | 0,84 % | Brak wpisu w KEV nie wyklucza ataków | |
| Jenkins Script Security Plugin | CVE-2026-92122 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define… |
8,8 | 0,63 % | Brak wpisu w KEV nie wyklucza ataków | |
| Jenkins Script Security Plugin | CVE-2026-92123 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses, and array accesses), allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass… |
8,8 | 0,63 % | Brak wpisu w KEV nie wyklucza ataków | |
| Jenkins Script Security Plugin | CVE-2026-92124 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection itself, allowing attackers with permission to define and run… |
8,8 | 0,63 % | Brak wpisu w KEV nie wyklucza ataków | |
| Jenkins Script Security Plugin | CVE-2026-92125 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox… |
8,8 | 0,56 % | Brak wpisu w KEV nie wyklucza ataków | |
| Jenkins Script Security Plugin | CVE-2026-92126 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a… |
8,5 | 0,62 % | Brak wpisu w KEV nie wyklucza ataków | |
| Jenkins Script Security Plugin | CVE-2026-92127 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define… |
8,0 | 0,61 % | Brak wpisu w KEV nie wyklucza ataków | |
| Jenkins Script Security Plugin | CVE-2026-92128 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the… |
7,5 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| Jenkins Script Security Plugin | CVE-2026-92129 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute… |
7,5 | 0,48 % | Brak wpisu w KEV nie wyklucza ataków | |
| RouterOS | CVE-2026-89028 MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a… |
8,2 | 0,58 % | Brak wpisu w KEV nie wyklucza ataków | |
| BIND 9 | CVE-2026-81563 A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This… |
7,5 | 0,57 % | Brak wpisu w KEV nie wyklucza ataków | |
| BIND 9 | CVE-2026-81736 If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through… |
7,5 | 0,57 % | Brak wpisu w KEV nie wyklucza ataków | |
| BIND 9 | CVE-2026-77692 An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through… |
7,5 | 6,56 % | Brak wpisu w KEV nie wyklucza ataków | |
| EKI-1242IEIMS / EKI-1242EIMS | CVE-2026-73177 Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without… |
8,6 | 0,15 % | Brak wpisu w KEV nie wyklucza ataków | |
| djust | CVE-2026-61590 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface (`eval_handler`). The localhost restriction was an opt-in… |
7,4 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| djust | CVE-2026-61598 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, `djust.mixins.model_binding.ModelBindingMixin` provides a default `update_model` event handler and is part of the LiveView base MRO, so every LiveView exposes it.… |
7,1 | 0,43 % | Brak wpisu w KEV nie wyklucza ataków | |
| BIND 9 | CVE-2026-19667 If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0… |
7,5 | 0,57 % | Brak wpisu w KEV nie wyklucza ataków | |
| Curiosity Workspace | CVE-2026-88817 An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access… |
8,7 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| EKI-1242IEIMS / EKI-1242EIMS | CVE-2026-73175 Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows an adjacent unauthenticated attacker to exhaust the server session pool and cause a complete denial of… |
7,1 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| EKI-1242IEIMS / EKI-1242EIMS | CVE-2026-73176 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute… |
8,6 | 1,18 % | Brak wpisu w KEV nie wyklucza ataków | |
| EKI-1242IEIMS / EKI-1242EIMS | CVE-2026-73170 Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the Modbus CSV import workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary Lua code on the device via a… |
8,6 | 0,54 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 23:02 UTC – 14.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.