Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the application, this content enables execution of arbitrary operating…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.
This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile._open, when an application calls Image.open() on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint.
To…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Certain HP DesignJet products may be potentially vulnerable to cross-site scripting (XSS), which may allow unauthenticated HTTP requests to view print job previews.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device.
Due to a wrong initialization, a process…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key
. The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the application, this content enables execution of arbitrary operating…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.
This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile._open, when an application calls Image.open() on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint.
To…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Certain HP DesignJet products may be potentially vulnerable to cross-site scripting (XSS), which may allow unauthenticated HTTP requests to view print job previews.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device.
Due to a wrong initialization, a process…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key
. The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,27 % · rekomendacja wg zapisanej polityki