KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list.…
libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel data at an address that is not properly aligned for float…
This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a…
Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026.
a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a ‘wtsapi32.dll’ file in the ‘C:\ProgramData\Evope\’ directory. The…
PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the…
A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue…
SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. This makes it…
Błąd w GIMP umożliwia zdalne wykonanie kodu przez złośliwy plik preset.
The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary…
An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted…
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP…
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP…
A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface…
mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1,…
Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Version header, through snprintf.
SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user's existing login sessions when the user's password is reset with a reset…
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from…
Wstrzyknięcie poleceń w Brocade SANnav pozwala atakującym na wykonanie dowolnych komend administracyjnych.
Podatność w Microsoft Office Outlook umożliwia zdalne wykonanie kodu.
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV…
Luka w konsoli OpenShift umożliwia nieautoryzowanemu atakującemu odczyt wrażliwych plików JSON.
Nieprawidłowe zarządzanie zaszyfrowanymi poświadczeniami w IBM DataStage umożliwia dostęp do wrażliwych informacji.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-95521 A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an… |
Monitoruj |
CVSS 7,8EPSS 0,58 % | ||
| CVE-2026-88360 libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can… |
Monitoruj |
CVSS 7,5EPSS 0,32 % | ||
| CVE-2026-96515 This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated… |
Monitoruj |
CVSS 8,6EPSS 0,32 % | ||
| CVE-2026-88907 Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026. |
Monitoruj |
CVSS 7,4EPSS 0,32 % | ||
| CVE-2026-7169 a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a… |
Monitoruj |
CVSS 7,5EPSS 0,14 % | ||
| CVE-2026-4638 PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead,… |
Monitoruj |
CVSS 7,1EPSS 0,31 % | ||
| CVE-2026-57590 A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to… |
Monitoruj |
CVSS 8,1EPSS 0,23 % | ||
| CVE-2026-78309 SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. |
Monitoruj |
CVSS 8,8EPSS 0,26 % | ||
| CVE-2026-78311 SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. |
Monitoruj |
CVSS 8,8EPSS 0,24 % | ||
| CVE-2026-85682 The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest nonce to… |
Monitoruj |
CVSS 8,8EPSS 0,14 % | ||
| CVE-2026-97185 Błąd w GIMP umożliwia zdalne wykonanie kodu przez złośliwy plik preset. |
Monitoruj |
CVSS 7,8EPSS 0,13 % | ||
| CVE-2026-77193 The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it… |
Monitoruj |
CVSS 7,5EPSS 0,36 % | ||
| CVE-2026-82077 An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated… |
Monitoruj |
CVSS 7,3EPSS 0,84 % | ||
| CVE-2026-88843 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the… |
Monitoruj |
CVSS 7,2EPSS 0,36 % | ||
| CVE-2026-80513 The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users… |
Monitoruj |
CVSS 7,5EPSS 0,32 % | ||
| CVE-2026-14780 A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An… |
Monitoruj |
CVSS 7,5EPSS 0,32 % | ||
| CVE-2026-97151 mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add… |
Monitoruj |
CVSS 8,4EPSS 0,36 % | ||
| CVE-2026-97152 Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Version header,… |
Monitoruj |
CVSS 8,6EPSS 0,31 % | ||
| CVE-2026-97056 SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user's… |
Monitoruj |
CVSS 7,6EPSS 0,43 % | ||
| CVE-2026-92470 GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an… |
Monitoruj |
CVSS 7,7EPSS 0,21 % | ||
| CVE-2026-82370 Wstrzyknięcie poleceń w Brocade SANnav pozwala atakującym na wykonanie dowolnych komend administracyjnych. |
Monitoruj |
CVSS 8,6EPSS 0,61 % | ||
| CVE-2026-70125 Podatność w Microsoft Office Outlook umożliwia zdalne wykonanie kodu. |
Monitoruj |
CVSS 7,8EPSS 0,32 % | ||
| CVE-2026-86583 The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import… |
Monitoruj |
CVSS 8,8EPSS 0,42 % | ||
| CVE-2026-75887 Luka w konsoli OpenShift umożliwia nieautoryzowanemu atakującemu odczyt wrażliwych plików JSON. |
Monitoruj |
CVSS 7,5EPSS 0,53 % | ||
| CVE-2026-81208 Nieprawidłowe zarządzanie zaszyfrowanymi poświadczeniami w IBM DataStage umożliwia dostęp do wrażliwych informacji. |
Monitoruj |
CVSS 7,7EPSS 0,34 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 7.11.2026, 23:32 UTC – 8.11.2026, 01:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.