KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway…
The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password.
CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries,…
Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec…
ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator…
In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument (pro attach <token>). On…
A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of…
NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability…
An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint. The…
Brak autoryzacji w API Apache DolphinScheduler umożliwia nieuprawniony dostęp do danych workflow.
An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted…
An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow…
An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move…
Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
Błąd w KVM w jądrze Linuxa pozwalał na nieprawidłowe śledzenie zapisów w różnych przestrzeniach adresowych.
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to…
Wykorzystanie poświadczeń w PyPy umożliwia atakującym uszkodzenie pamięci przez złośliwy XML.
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability,…
Problem z izolacją stron w komponencie Panning i Zooming może prowadzić do ujawnienia danych.
Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157.
Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Wykorzystanie luki w WebAssembly w JavaScript umożliwia zdalne wykonanie kodu.
Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-100289 Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and… |
Pozostałe |
CVSS 5,0EPSS 0,16 % | ||
| CVE-2026-22101 The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and… |
Pozostałe |
CVSS 5,1EPSS 0,14 % | ||
| CVE-2026-102567 CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft… |
Pozostałe |
CVSS 6,1EPSS 0,12 % | ||
| CVE-2026-102568 Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root.… |
Pozostałe |
CVSS 6,8EPSS 0,17 % | ||
| CVE-2026-102570 ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescaped into the… |
Pozostałe |
CVSS 5,5EPSS 0,29 % | ||
| CVE-2026-102371 In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu… |
Pozostałe |
CVSS 5,7EPSS 0,11 % | ||
| CVE-2026-102491 A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file… |
Pozostałe |
CVSS 5,5EPSS 0,25 % | ||
| CVE-2025-33207 NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a… |
Pozostałe |
CVSS 6,8EPSS 0,15 % | ||
| CVE-2026-71898 An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the… |
Pozostałe |
CVSS 4,3EPSS 0,18 % | ||
| CVE-2026-71899 Brak autoryzacji w API Apache DolphinScheduler umożliwia nieuprawniony dostęp do danych workflow. |
Pozostałe |
CVSS 6,5EPSS 0,23 % | ||
| CVE-2026-78214 An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path… |
Pozostałe |
CVSS 5,3EPSS 0,35 % | ||
| CVE-2026-81569 An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke… |
Pozostałe |
CVSS 4,3EPSS 0,23 % | ||
| CVE-2026-71897 An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they… |
Pozostałe |
CVSS 4,3EPSS 0,18 % | ||
| CVE-2026-96869 Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR… |
Pozostałe |
CVSS 4,3EPSS 0,24 % | ||
| CVE-2026-98164 Błąd w KVM w jądrze Linuxa pozwalał na nieprawidłowe śledzenie zapisów w różnych przestrzeniach adresowych. |
Pozostałe |
CVSS 5,5EPSS 0,15 % | ||
| CVE-2026-76114 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sensitive Information vulnerability. An unauthenticated attacker with… |
Pozostałe |
CVSS 5,9EPSS 0,14 % | ||
| CVE-2026-76875 Wykorzystanie poświadczeń w PyPy umożliwia atakującym uszkodzenie pamięci przez złośliwy XML. |
Pozostałe |
CVSS 6,3EPSS 0,24 % | ||
| CVE-2026-73599 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker… |
Pozostałe |
CVSS 5,4EPSS 0,15 % | ||
| CVE-2026-100821 Problem z izolacją stron w komponencie Panning i Zooming może prowadzić do ujawnienia danych. |
Pozostałe |
CVSS 4,7EPSS 0,14 % | ||
| CVE-2026-100822 Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
Pozostałe |
CVSS 5,4EPSS 0,28 % | ||
| CVE-2026-100823 Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157. |
PozostałePubliczny PoC |
CVSS 5,4EPSS 0,16 % | ||
| CVE-2026-100826 Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
Pozostałe |
CVSS 6,5EPSS 0,22 % | ||
| CVE-2026-100812 Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
Pozostałe |
CVSS 6,5EPSS 0,27 % | ||
| CVE-2026-100817 Wykorzystanie luki w WebAssembly w JavaScript umożliwia zdalne wykonanie kodu. |
Pozostałe |
CVSS 5,4EPSS 0,2 % | ||
| CVE-2026-100802 Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
Pozostałe |
CVSS 4,3EPSS 0,24 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 4.11.2026, 14:11 UTC – 4.11.2026, 15:21 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.