Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restrictions…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played,…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, `EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the linker joins it onto the install prefix and writes an executable Python script.…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output.
Hex compares a fetched tarball's inner and outer checksums with the repository's signed…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
CVSS
6,9
EPSS
0,19 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restrictions…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, `EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the linker joins it onto the install prefix and writes an executable Python script.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output.
Hex compares a fetched tarball's inner and outer checksums with the repository's signed…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
6,9
0,19 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.