KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when…
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that…
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in…
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or…
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event_manager.py appends a Client object to the clients list for each unique uuid submitted to the authenticated getEvents…
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before…
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS…
free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/api_datarepository.go validate the ueId path value with a regular expression whose…
An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file (i.e., recognized with attributes). In this case, an error is thrown which - together with…
Atak typu denial-of-service w komponencie SVG w Firefoxie powoduje awarię przeglądarki.
Atak typu denial-of-service w komponencie zabezpieczeń Firefoksa powoduje awarię aplikacji.
Problem z izolacją stron w trybie czytania w Firefox umożliwia atakującym dostęp do danych.
Problem spoofingu w komponencie nawigacji DOM umożliwia oszustwo użytkowników.
Ujawnienie informacji w komponencie sieciowym Firefoksa może prowadzić do wycieku danych.
Atak typu denial-of-service w komponencie Audio/Video w Firefox i Thunderbird powoduje awarię aplikacji.
Obejście zabezpieczeń w komponencie powiadomień DOM umożliwia nieautoryzowany dostęp.
Obejście zabezpieczeń w komponencie Copy & Paste i Drag & Drop w DOM umożliwia atak.
Ujawnienie informacji w komponencie Graphics: ImageLib w Firefox umożliwia dostęp do wrażliwych danych.
Use-after-free w komponencie Web Codecs w Firefox umożliwia zdalne wykonanie kodu.
The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output…
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access…
Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User->setupRedis() returns false when Redis cannot…
Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key…
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different…
Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-52724 Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp… |
Pozostałe |
CVSS 5,8EPSS 0,35 % | ||
| CVE-2026-54168 Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token… |
Pozostałe |
CVSS 6,5EPSS 0,59 % | ||
| CVE-2026-48722 Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to… |
Pozostałe |
CVSS 5,5EPSS 0,14 % | ||
| CVE-2026-48737 pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web/check.py relies on Python's global-address… |
Pozostałe |
CVSS 4,9EPSS 0,29 % | ||
| CVE-2026-48987 pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event_manager.py appends a Client object to the… |
Pozostałe |
CVSS 6,5EPSS 0,44 % | ||
| CVE-2026-49446 Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in… |
Pozostałe |
CVSS 6,1EPSS 0,3 % | ||
| CVE-2026-50166 Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually… |
Pozostałe |
CVSS 5,5EPSS 0,27 % | ||
| CVE-2026-47780 free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr… |
Pozostałe |
CVSS 6,9EPSS 0,54 % | ||
| CVE-2026-25826 An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file (i.e., recognized… |
Pozostałe |
CVSS 4,9EPSS 0,39 % | ||
| CVE-2026-92077 Atak typu denial-of-service w komponencie SVG w Firefoxie powoduje awarię przeglądarki. |
Pozostałe |
CVSS 6,5EPSS 0,27 % | ||
| CVE-2026-92078 Atak typu denial-of-service w komponencie zabezpieczeń Firefoksa powoduje awarię aplikacji. |
Pozostałe |
CVSS 6,5EPSS 0,22 % | ||
| CVE-2026-92068 Problem z izolacją stron w trybie czytania w Firefox umożliwia atakującym dostęp do danych. |
Pozostałe |
CVSS 5,4EPSS 0,11 % | ||
| CVE-2026-92069 Problem spoofingu w komponencie nawigacji DOM umożliwia oszustwo użytkowników. |
Pozostałe |
CVSS 5,4EPSS 0,18 % | ||
| CVE-2026-92070 Ujawnienie informacji w komponencie sieciowym Firefoksa może prowadzić do wycieku danych. |
Pozostałe |
CVSS 4,3EPSS 0,19 % | ||
| CVE-2026-92063 Atak typu denial-of-service w komponencie Audio/Video w Firefox i Thunderbird powoduje awarię aplikacji. |
Pozostałe |
CVSS 6,5EPSS 0,38 % | ||
| CVE-2026-92039 Obejście zabezpieczeń w komponencie powiadomień DOM umożliwia nieautoryzowany dostęp. |
Pozostałe |
CVSS 6,3EPSS 0,2 % | ||
| CVE-2026-92030 Obejście zabezpieczeń w komponencie Copy & Paste i Drag & Drop w DOM umożliwia atak. |
Pozostałe |
CVSS 5,4EPSS 0,22 % | ||
| CVE-2026-92031 Ujawnienie informacji w komponencie Graphics: ImageLib w Firefox umożliwia dostęp do wrażliwych danych. |
Pozostałe |
CVSS 6,5EPSS 0,31 % | ||
| CVE-2026-92005 Use-after-free w komponencie Web Codecs w Firefox umożliwia zdalne wykonanie kodu. |
Pozostałe |
CVSS 5,3EPSS 0,36 % | ||
| CVE-2026-15609 The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and… |
Pozostałe |
CVSS 6,4EPSS 0,26 % | ||
| CVE-2026-91997 evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics… |
Pozostałe |
CVSS 5,3EPSS 0,45 % | ||
| CVE-2026-92002 Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication… |
Pozostałe |
CVSS 5,1EPSS 0,53 % | ||
| CVE-2026-92003 Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API… |
Pozostałe |
CVSS 6,9EPSS 0,57 % | ||
| CVE-2026-91993 Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other… |
Pozostałe |
CVSS 5,3EPSS 0,34 % | ||
| CVE-2026-77117 Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter… |
Pozostałe |
CVSS 5,9EPSS 0,36 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 9.11.2026, 19:32 UTC – 9.11.2026, 21:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.