KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges,…
The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification…
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.
The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their…
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid.
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks.
The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site…
The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing…
Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item and writes it to a generated data-rlta-url attribute. The browser code…
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may…
Przepełnienie bufora w Cesanta Mongoose umożliwia zdalne wykonanie kodu.
A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to…
A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request…
In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute…
A vulnerability was detected in Eyeplus 57.0.0.0308. The affected element is the function GetUsers of the file /onvif/Device of the component ONVIF. The manipulation results in information disclosure. The attack can be executed remotely. The exploit is now…
Brak uwierzytelnienia w REST API GEOritm pozwala na zdalny dostęp do obiektów.
A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown function of the file application/controllers/Items.php of the component Items Management…
A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper of the component Wallpaper Upload. This manipulation of the argument wallpaper causes improper…
A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function stream of the file public/stream.php. The manipulation of the argument url results in server-side request forgery. It is possible to launch…
A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function open_graph::fetch of the file src/api/resource.rs of the component open_graphic_parse Endpoint. Executing a manipulation of the argument url can…
A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1. Impacted is the function arc_parse_canon_t in the library libopenarc/arc-canon.c of the component libopenarc. The manipulation results in null pointer dereference. The…
Obejście uwierzytelnienia w fuzui StudentInfo umożliwia zdalny dostęp bez autoryzacji.
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c of the component SPF Parser. This manipulation of the argument cp…
Błąd kodowania w OpenDMARC umożliwia zdalne przeprowadzenie ataku.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-88828 The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner… |
Pozostałe |
CVSS 5,4EPSS 0,16 % | ||
| CVE-2026-89300 The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own… |
Pozostałe |
CVSS 5,3EPSS 0,18 % | ||
| CVE-2026-89303 The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL… |
Pozostałe |
CVSS 6,4EPSS 0,14 % | ||
| CVE-2026-89411 The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an… |
Pozostałe |
CVSS 5,3EPSS 0,11 % | ||
| CVE-2026-92996 The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing… |
Pozostałe |
CVSS 5,3EPSS 0,11 % | ||
| CVE-2026-93000 The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated… |
Pozostałe |
CVSS 6,8EPSS 0,22 % | ||
| CVE-2026-84744 The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing… |
Pozostałe |
CVSS 6,5EPSS 0,21 % | ||
| CVE-2026-86838 The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to… |
Pozostałe |
CVSS 5,3EPSS 0,25 % | ||
| CVE-2026-100751 Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item… |
Pozostałe |
CVSS 6,1EPSS 0,18 % | ||
| CVE-2026-101005 A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection.… |
Pozostałe |
CVSS 5,5EPSS 0,3 % | ||
| CVE-2026-101003 Przepełnienie bufora w Cesanta Mongoose umożliwia zdalne wykonanie kodu. |
Pozostałe |
CVSS 5,5EPSS 0,46 % | ||
| CVE-2026-101004 A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component… |
Pozostałe |
CVSS 6,9EPSS 0,5 % | ||
| CVE-2026-100909 A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The… |
Pozostałe |
CVSS 5,5EPSS 0,3 % | ||
| CVE-2026-87723 In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH… |
Pozostałe |
CVSS 5,4EPSS 0,11 % | ||
| CVE-2026-100907 Wykryta luka w Eyeplus umożliwia zdalne ujawnienie informacji. |
Pozostałe |
CVSS 5,5EPSS 0,29 % | ||
| CVE-2026-100906 A vulnerability was detected in Eyeplus 57.0.0.0308. The affected element is the function GetUsers of the file /onvif/Device of the component ONVIF. The manipulation results in information… |
Pozostałe |
CVSS 5,5EPSS 0,29 % | ||
| CVE-2026-100903 Brak uwierzytelnienia w REST API GEOritm pozwala na zdalny dostęp do obiektów. |
Pozostałe |
CVSS 5,5EPSS 0,56 % | ||
| CVE-2026-100904 A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown function of the… |
Pozostałe |
CVSS 5,1EPSS 0,19 % | ||
| CVE-2026-100902 A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper of the component Wallpaper… |
Pozostałe |
CVSS 5,7EPSS 0,33 % | ||
| CVE-2026-100901 A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function stream of the file public/stream.php. The manipulation of the… |
Pozostałe |
CVSS 5,5EPSS 0,28 % | ||
| CVE-2026-100893 A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function open_graph::fetch of the file src/api/resource.rs of the component… |
Pozostałe |
CVSS 5,5EPSS 0,28 % | ||
| CVE-2026-100895 A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1. Impacted is the function arc_parse_canon_t in the library libopenarc/arc-canon.c of the component… |
Pozostałe |
CVSS 5,5EPSS 0,4 % | ||
| CVE-2026-100897 Obejście uwierzytelnienia w fuzui StudentInfo umożliwia zdalny dostęp bez autoryzacji. |
Pozostałe |
CVSS 5,1EPSS 0,16 % | ||
| CVE-2026-100890 A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c… |
Pozostałe |
CVSS 5,5EPSS 0,37 % | ||
| CVE-2026-100891 Błąd kodowania w OpenDMARC umożliwia zdalne przeprowadzenie ataku. |
Pozostałe |
CVSS 5,5EPSS 0,29 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 5.11.2026, 07:02 UTC – 5.11.2026, 08:32 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.