KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to read private child issue contents, including…
A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect.
Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTeradataOperator` and `AzureBlobStorageToTeradataOperator` interpolate the source bucket's credentials as plain string literals into the `CREATE MULTISET…
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore…
Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.snowflakecomputing.com/api/v2/statements`, so an `account`…
The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is…
Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability. These servlets…
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern…
A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c…
GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private…
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactoryImpl.checkSecurity() resolves the roles required for an invocation and, when no ACL rule matches…
Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application…
Nieprawidłowa autoryzacja w tacomall umożliwia zdalne wykorzystanie podatności.
Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to…
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (64 bytes, or 128 bytes for sha384 and sha512) is passed to HMAC as the key on…
A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The…
Brak autoryzacji w REBUILD umożliwia zdalne ataki na plik /commons/file-editor-save.
Brak uwierzytelnienia w MODSetter SurfSense umożliwia zdalny dostęp do komponentu circleback.
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be…
Błąd w OpenDMARC umożliwia zdalne przeprowadzenie nieprawidłowej autoryzacji.
GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox…
GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with…
A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file libopendmarc/opendmarc_policy.c of the component DMARC Parser. The manipulation of the argument pct leads to integer…
mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST…
The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field (ctx->user_data = INT_TO_POINTER(-status) in zsock_accepted_cb(), zsock_received_cb(), zsock_connected_cb() and…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-8937 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed… |
Pozostałe |
CVSS 4,3EPSS 0,23 % | ||
| CVE-2026-76720 A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect. |
Pozostałe |
CVSS 4,3EPSS 0,17 % | ||
| CVE-2026-81862 Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTeradataOperator` and `AzureBlobStorageToTeradataOperator` interpolate the source… |
Pozostałe |
CVSS 6,5EPSS 0,4 % | ||
| CVE-2026-81914 Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote… |
PozostałePubliczny PoC |
CVSS 4,3EPSS 0,47 % | ||
| CVE-2026-81930 Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as… |
Pozostałe |
CVSS 6,3EPSS 0,43 % | ||
| CVE-2026-86843 The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster… |
PozostałePubliczny PoC |
CVSS 6,3EPSS 0,56 % | ||
| CVE-2026-11796 Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in… |
Pozostałe |
CVSS 5,1EPSS 0,25 % | ||
| CVE-2026-102473 A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames,… |
Pozostałe |
CVSS 5,5EPSS 0,1 % | ||
| CVE-2026-102474 A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can… |
Pozostałe |
CVSS 4,0EPSS 0,11 % | ||
| CVE-2026-10518 GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an… |
Pozostałe |
CVSS 4,3EPSS 0,23 % | ||
| CVE-2026-91085 Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactoryImpl.checkSecurity() resolves… |
Pozostałe |
CVSS 6,3EPSS 0,37 % | ||
| CVE-2026-86157 Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters… |
Pozostałe |
CVSS 5,6EPSS 0,12 % | ||
| CVE-2026-102293 Nieprawidłowa autoryzacja w tacomall umożliwia zdalne wykorzystanie podatności. |
Pozostałe |
CVSS 5,5EPSS 0,28 % | ||
| CVE-2026-97029 Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same… |
Pozostałe |
CVSS 5,7EPSS 0,25 % | ||
| CVE-2026-102414 pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (64 bytes,… |
Pozostałe |
CVSS 6,3EPSS 0,35 % | ||
| CVE-2026-102248 A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper… |
Pozostałe |
CVSS 5,5EPSS 0,38 % | ||
| CVE-2026-102249 Brak autoryzacji w REBUILD umożliwia zdalne ataki na plik /commons/file-editor-save. |
Pozostałe |
CVSS 5,5EPSS 0,28 % | ||
| CVE-2026-102245 Brak uwierzytelnienia w MODSetter SurfSense umożliwia zdalny dostęp do komponentu circleback. |
Pozostałe |
CVSS 5,5EPSS 0,39 % | ||
| CVE-2026-101280 A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The… |
Pozostałe |
CVSS 5,5EPSS 0,4 % | ||
| CVE-2026-101281 Błąd w OpenDMARC umożliwia zdalne przeprowadzenie nieprawidłowej autoryzacji. |
Pozostałe |
CVSS 5,5EPSS 0,41 % | ||
| CVE-2026-102372 GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket… |
Pozostałe |
CVSS 5,3EPSS 0,21 % | ||
| CVE-2026-102374 GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping.… |
Pozostałe |
CVSS 5,3EPSS 0,21 % | ||
| CVE-2026-101279 A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file libopendmarc/opendmarc_policy.c of the component… |
Pozostałe |
CVSS 5,5EPSS 0,33 % | ||
| CVE-2026-102367 mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user… |
Pozostałe |
CVSS 5,3EPSS 0,18 % | ||
| CVE-2026-18417 The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field (ctx->user_data = INT_TO_POINTER(-status) in… |
Pozostałe |
CVSS 6,5EPSS 0,18 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 4.11.2026, 22:03 UTC – 5.11.2026, 00:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.