Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects. Attackers can submit a URL to POST /api/Cbl/upload-cbl-file whose host rebinds or redirects to internal addresses…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId} requests with a victim's binding id to remove their…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the generated search…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target run_id in the request body without ownership verification. The AgentCRUD.create_task and…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.
We have already fixed the vulnerability in the following version:
Qsync…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
Qsync Central…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
Qsync Central…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/_Session to…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This issue affects some unknown processing of the file /order/generateOrder of the component Coupon Redemption. Such manipulation of the argument couponId leads to race condition. The attack may be performed from remote.…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.
This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and manage_settings checks. A low-privileged staff account with…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects. Attackers can submit a URL to POST /api/Cbl/upload-cbl-file whose host rebinds or redirects to internal addresses…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId} requests with a victim's binding id to remove their…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the generated search…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target run_id in the request body without ownership verification. The AgentCRUD.create_task and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.
We have already fixed the vulnerability in the following version:
Qsync…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
Qsync Central…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
Qsync Central…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/_Session to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This issue affects some unknown processing of the file /order/generateOrder of the component Coupon Redemption. Such manipulation of the argument couponId leads to race condition. The attack may be performed from remote.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.
This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and manage_settings checks. A low-privileged staff account with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki