KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that…
Brak uwierzytelnienia w Taskview Community pozwala na rejestrację fałszywych klientów OAuth i przejęcie kont użytkowników.
The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the…
Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.
Nieprawidłowe zarządzanie danymi w Brocade SANnav ujawnia klucze w logach aplikacji.
The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated or replaced. Under certain connection conditions, a newly established…
The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent…
The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably unpredictable source. An unauthenticated attacker with adjacent network access and knowledge that an active session exists could…
The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication…
PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that…
An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed…
An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Assessment content at or…
Ekspozycja danych uwierzytelniających w logach Brocade SANnav umożliwia przejęcie kontroli nad infrastrukturą sieciową.
ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an authenticated user to access data within the ServiceNow AI Platform that the user otherwise…
ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what…
ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an unauthenticated user to access data within the ServiceNow AI Platform that the user…
Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Protection…
TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in…
TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llm_base_url through the settings API when the LLM_PARSING feature is enabled. Write permission to the target trip instance is required…
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the `srcdoc`…
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in `SharpEditorFormField`: attacker-controlled content bearing the…
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the…
Luka w Docmost pozwala na usunięcie dowolnych plików przez uwierzytelnionych użytkowników.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-96883 pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as… |
Monitoruj |
CVSS 8,7EPSS 0,65 % | ||
| CVE-2026-93354 Brak uwierzytelnienia w Taskview Community pozwala na rejestrację fałszywych klientów OAuth i przejęcie kont użytkowników. |
Monitoruj |
CVSS 8,5EPSS 0,27 % | ||
| CVE-2026-88956 The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a… |
Monitoruj |
CVSS 7,0EPSS 0,22 % | ||
| CVE-2026-82164 Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could… |
Monitoruj |
CVSS 7,1EPSS 0,09 % | ||
| CVE-2026-82372 Nieprawidłowe zarządzanie danymi w Brocade SANnav ujawnia klucze w logach aplikacji. |
Monitoruj |
CVSS 8,5EPSS 0,17 % | ||
| CVE-2026-82566 The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated… |
Monitoruj |
CVSS 8,7EPSS 0,28 % | ||
| CVE-2026-84399 The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated… |
Monitoruj |
CVSS 8,7EPSS 0,19 % | ||
| CVE-2026-85496 The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably unpredictable source. An unauthenticated attacker with… |
Monitoruj |
CVSS 7,7EPSS 0,25 % | ||
| CVE-2026-77967 The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated… |
Monitoruj |
CVSS 8,6EPSS 0,24 % | ||
| CVE-2026-96748 PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value… |
Monitoruj |
CVSS 8,3EPSS 0,36 % | ||
| CVE-2026-96749 An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount… |
Monitoruj |
CVSS 7,5EPSS 0,19 % | ||
| CVE-2026-89325 An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted… |
Monitoruj |
CVSS 7,8EPSS 0,13 % | ||
| CVE-2026-82371 Ekspozycja danych uwierzytelniających w logach Brocade SANnav umożliwia przejęcie kontroli nad infrastrukturą sieciową. |
Monitoruj |
CVSS 8,5EPSS 0,13 % | ||
| CVE-2026-86857 ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an authenticated user to… |
Monitoruj |
CVSS 8,4EPSS 0,25 % | ||
| CVE-2026-86858 ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain… |
Monitoruj |
CVSS 8,7EPSS 0,28 % | ||
| CVE-2026-86859 ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an unauthenticated user… |
Monitoruj |
CVSS 8,7EPSS 0,3 % | ||
| CVE-2026-81455 Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could… |
Monitoruj |
CVSS 8,6EPSS 0,26 % | ||
| CVE-2026-81473 Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this… |
Monitoruj |
CVSS 8,1EPSS 0,09 % | ||
| CVE-2026-82157 Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could… |
Monitoruj |
CVSS 8,3EPSS 0,12 % | ||
| CVE-2026-77293 TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the… |
Monitoruj |
CVSS 7,1EPSS 0,38 % | ||
| CVE-2026-77294 TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llm_base_url through the settings API when the LLM_PARSING feature… |
Monitoruj |
CVSS 8,1EPSS 0,31 % | ||
| CVE-2026-61823 code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the… |
Monitoruj |
CVSS 7,3EPSS 0,21 % | ||
| CVE-2026-61825 code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in… |
Monitoruj |
CVSS 8,7EPSS 0,23 % | ||
| CVE-2026-57440 The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to… |
Monitoruj |
CVSS 7,5EPSS 0,33 % | ||
| CVE-2026-48070 Luka w Docmost pozwala na usunięcie dowolnych plików przez uwierzytelnionych użytkowników. |
Monitoruj |
CVSS 7,1EPSS 0,37 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 5.11.2026, 23:32 UTC – 6.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.