Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to…
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other…
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving…
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The…
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers…
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of…
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,17 % · rekomendacja wg zapisanej polityki