KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes…
vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.
vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescriptor() or…
vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError (for example by calling eval with malformed…
A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation results in resource consumption. The attack may be launched remotely. The patch is identified as…
vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sys` builtin (an…
Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control…
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly…
Podatność SSRF w Dell OpenManage Server Administrator umożliwia atakującemu zdalne manipulowanie żądaniami.
Luka w Dell OpenManage Server Administrator umożliwia atakującemu dostęp do systemu plików.
Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.
Podatność CSRF w Dell OpenManage Server Administrator umożliwia zdalne wykonanie kodu przez nieautoryzowanego atakującego.
Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token…
Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.
Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.
In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity.
Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.
Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.
Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.
Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.
Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-92973 ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI… |
Pozostałe |
CVSS 5,3EPSS 0,39 % | ||
| CVE-2026-92963 vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object… |
Pozostałe |
CVSS 6,9EPSS 0,34 % | ||
| CVE-2026-92949 vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly()… |
Pozostałe |
CVSS 6,3EPSS 0,32 % | ||
| CVE-2026-92936 vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer… |
Pozostałe |
CVSS 6,9EPSS 0,46 % | ||
| CVE-2026-92879 A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation results in resource consumption.… |
Pozostałe |
CVSS 5,3EPSS 0,59 % | ||
| CVE-2026-92933 vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in… |
Pozostałe |
CVSS 6,9EPSS 0,37 % | ||
| CVE-2026-86522 Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset… |
Pozostałe |
CVSS 6,3EPSS 0,74 % | ||
| CVE-2026-81829 A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is… |
Pozostałe |
CVSS 5,3EPSS 0,59 % | ||
| CVE-2026-81443 Podatność SSRF w Dell OpenManage Server Administrator umożliwia atakującemu zdalne manipulowanie żądaniami. |
Pozostałe |
CVSS 6,4EPSS 0,23 % | ||
| CVE-2026-81453 Luka w Dell OpenManage Server Administrator umożliwia atakującemu dostęp do systemu plików. |
Pozostałe |
CVSS 6,5EPSS 0,45 % | ||
| CVE-2026-78294 Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. |
Pozostałe |
CVSS 6,5EPSS 0,22 % | ||
| CVE-2026-78528 Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions. |
Pozostałe |
CVSS 5,3EPSS 0,29 % | ||
| CVE-2026-80355 Podatność CSRF w Dell OpenManage Server Administrator umożliwia zdalne wykonanie kodu przez nieautoryzowanego atakującego. |
Pozostałe |
CVSS 5,4EPSS 0,21 % | ||
| CVE-2026-78223 Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write… |
Pozostałe |
CVSS 6,9EPSS 0,44 % | ||
| CVE-2026-74002 Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions. |
Pozostałe |
CVSS 5,3EPSS 0,29 % | ||
| CVE-2026-74005 Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions. |
Pozostałe |
CVSS 5,4EPSS 0,14 % | ||
| CVE-2026-74017 Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions. |
Pozostałe |
CVSS 5,3EPSS 0,31 % | ||
| CVE-2026-73999 Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions. |
Pozostałe |
CVSS 5,4EPSS 0,29 % | ||
| CVE-2026-74000 Contributor Broken Access Control in Simple Membership <= 4.8.2 versions. |
Pozostałe |
CVSS 5,3EPSS 0,29 % | ||
| CVE-2026-71568 In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack… |
Pozostałe |
CVSS 5,3EPSS 0,23 % | ||
| CVE-2026-66676 Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions. |
Pozostałe |
CVSS 5,3EPSS 0,31 % | ||
| CVE-2026-66608 Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions. |
Pozostałe |
CVSS 6,4EPSS 0,23 % | ||
| CVE-2026-66617 Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions. |
Pozostałe |
CVSS 6,5EPSS 0,22 % | ||
| CVE-2026-66575 Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions. |
Pozostałe |
CVSS 5,3EPSS 0,29 % | ||
| CVE-2026-66576 Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions. |
Pozostałe |
CVSS 6,5EPSS 0,22 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 8.11.2026, 23:02 UTC – 9.11.2026, 00:32 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.