KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the…
A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue…
SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. This makes it…
Błąd w GIMP umożliwia zdalne wykonanie kodu przez złośliwy plik preset.
The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary…
An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted…
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP…
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP…
A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface…
mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1,…
Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Version header, through snprintf.
SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user's existing login sessions when the user's password is reset with a reset…
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from…
Wstrzyknięcie poleceń w Brocade SANnav pozwala atakującym na wykonanie dowolnych komend administracyjnych.
Podatność w Microsoft Office Outlook umożliwia zdalne wykonanie kodu.
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV…
Luka w konsoli OpenShift umożliwia nieautoryzowanemu atakującemu odczyt wrażliwych plików JSON.
Nieprawidłowe zarządzanie zaszyfrowanymi poświadczeniami w IBM DataStage umożliwia dostęp do wrażliwych informacji.
Wstrzyknięcie XXE w IBM DataStage umożliwia zdalnemu atakującemu uzyskanie poufnych informacji.
Wstrzyknięcie poleceń w IBM DataStage umożliwia zdalne wykonanie kodu przez uwierzytelnionego atakującego.
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification…
Nieprawidłowe escape'owanie wartości właściwości w IBM DataStage umożliwia zdalne wykonanie kodu.
Nieprawidłowa neutralizacja elementów w IBM DataStage umożliwia zdalne wykonanie dowolnych poleceń.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-4638 PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead,… |
Monitoruj |
CVSS 7,1EPSS 0,31 % | ||
| CVE-2026-57590 A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to… |
Monitoruj |
CVSS 8,1EPSS 0,23 % | ||
| CVE-2026-78309 SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. |
Monitoruj |
CVSS 8,8EPSS 0,26 % | ||
| CVE-2026-78311 SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. |
Monitoruj |
CVSS 8,8EPSS 0,24 % | ||
| CVE-2026-85682 The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest nonce to… |
Monitoruj |
CVSS 8,8EPSS 0,14 % | ||
| CVE-2026-97185 Błąd w GIMP umożliwia zdalne wykonanie kodu przez złośliwy plik preset. |
Monitoruj |
CVSS 7,8EPSS 0,13 % | ||
| CVE-2026-77193 The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it… |
Monitoruj |
CVSS 7,5EPSS 0,36 % | ||
| CVE-2026-82077 An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated… |
Monitoruj |
CVSS 7,3EPSS 0,84 % | ||
| CVE-2026-88843 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the… |
Monitoruj |
CVSS 7,2EPSS 0,36 % | ||
| CVE-2026-80513 The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users… |
Monitoruj |
CVSS 7,5EPSS 0,32 % | ||
| CVE-2026-14780 A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An… |
Monitoruj |
CVSS 7,5EPSS 0,32 % | ||
| CVE-2026-97151 mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add… |
Monitoruj |
CVSS 8,4EPSS 0,36 % | ||
| CVE-2026-97152 Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Version header,… |
Monitoruj |
CVSS 8,6EPSS 0,31 % | ||
| CVE-2026-97056 SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user's… |
Monitoruj |
CVSS 7,6EPSS 0,43 % | ||
| CVE-2026-92470 GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an… |
Monitoruj |
CVSS 7,7EPSS 0,21 % | ||
| CVE-2026-82370 Wstrzyknięcie poleceń w Brocade SANnav pozwala atakującym na wykonanie dowolnych komend administracyjnych. |
Monitoruj |
CVSS 8,6EPSS 0,61 % | ||
| CVE-2026-70125 Podatność w Microsoft Office Outlook umożliwia zdalne wykonanie kodu. |
Monitoruj |
CVSS 7,8EPSS 0,32 % | ||
| CVE-2026-86583 The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import… |
Monitoruj |
CVSS 8,8EPSS 0,42 % | ||
| CVE-2026-75887 Luka w konsoli OpenShift umożliwia nieautoryzowanemu atakującemu odczyt wrażliwych plików JSON. |
Monitoruj |
CVSS 7,5EPSS 0,53 % | ||
| CVE-2026-81208 Nieprawidłowe zarządzanie zaszyfrowanymi poświadczeniami w IBM DataStage umożliwia dostęp do wrażliwych informacji. |
Monitoruj |
CVSS 7,7EPSS 0,34 % | ||
| CVE-2026-81536 Wstrzyknięcie XXE w IBM DataStage umożliwia zdalnemu atakującemu uzyskanie poufnych informacji. |
Monitoruj |
CVSS 7,7EPSS 0,47 % | ||
| CVE-2026-81537 Wstrzyknięcie poleceń w IBM DataStage umożliwia zdalne wykonanie kodu przez uwierzytelnionego atakującego. |
Monitoruj |
CVSS 8,8EPSS 1,7 % | ||
| CVE-2026-19125 The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in… |
Monitoruj |
CVSS 8,1EPSS 0,7 % | ||
| CVE-2026-80412 Nieprawidłowe escape'owanie wartości właściwości w IBM DataStage umożliwia zdalne wykonanie kodu. |
Monitoruj |
CVSS 8,8EPSS 0,81 % | ||
| CVE-2026-80425 Nieprawidłowa neutralizacja elementów w IBM DataStage umożliwia zdalne wykonanie dowolnych poleceń. |
Monitoruj |
CVSS 8,8EPSS 0,79 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 6.11.2026, 07:02 UTC – 6.11.2026, 12:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.