KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration…
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled custom_field_table value without validating it against the allowed custom-field table names.…
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata. When an administrator uploads an image through…
Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup…
IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker could exploit this vulnerability to write arbitrary files to the system.
Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain(). In RELEASE/NO_ASSERT builds, the…
FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw.
A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/units_add_blockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads…
Błąd w jądrze Linuxa w rtw_sdio_if1_init prowadzi do uszkodzenia pamięci przez niewłaściwe zwolnienie HalData.
Błąd w jądrze Linux pozwala na zapis danych mimo nieudanej operacji PREFLUSH, co może prowadzić do utraty danych.
Wyciekanie połączeń w kernelu Linux w funkcji smb2_tree_connect może prowadzić do wyczerpania zasobów.
A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can dereference a freed sheet-object component, causing Gnumeric to crash.
Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory,…
Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c…
IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database.
The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar…
The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (exactly 69 characters) and a suffix check (ending in ".onion"), without performing…
The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS). User-supplied data originating from imported crawler captures—specifically item IDs, URLs, and screenshot file paths—was interpolated…
The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS). A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers (e.g., <img src=x…
Błąd w jądrze Linuxa pozwala na pozostawienie wpisów debugfs po wyrejestrowaniu, co może prowadzić do konfliktów.
Wycieki pamięci w sterowniku RTL8723BS mogą prowadzić do wyczerpania zasobów i braku możliwości wysyłania ramek.
Błąd w jądrze Linuxa pozwalał na wystąpienie błędów GPU podczas odzyskiwania, co mogło prowadzić do awarii.
Błąd w jądrze Linux w iwlwifi umożliwia nieprawidłowe przekazywanie argumentów, co może prowadzić do awarii.
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shorter or longer than…
In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before the failable slave…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-67236 RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded… |
PozostałePubliczny PoC |
CVSS 6,5EPSS 0,17 % | ||
| CVE-2026-54790 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled custom_field_table value… |
Pozostałe |
CVSS 6,0EPSS 0,28 % | ||
| CVE-2026-39372 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachments without… |
Pozostałe |
CVSS 4,9EPSS 0,35 % | ||
| CVE-2026-100230 Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal,… |
Pozostałe |
CVSS 5,3EPSS 0,65 % | ||
| CVE-2026-84882 IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker could exploit this… |
Pozostałe |
CVSS 6,5EPSS 0,35 % | ||
| CVE-2026-88389 Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL… |
Pozostałe |
CVSS 6,2EPSS 0,16 % | ||
| CVE-2026-93030 FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw. |
Pozostałe |
CVSS 6,5EPSS 0,28 % | ||
| CVE-2026-97864 A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/units_add_blockAjax.php of the component Unit… |
Pozostałe |
CVSS 5,3EPSS 0,56 % | ||
| CVE-2026-98160 Błąd w jądrze Linuxa w rtw_sdio_if1_init prowadzi do uszkodzenia pamięci przez niewłaściwe zwolnienie HalData. |
Pozostałe |
CVSS 5,5EPSS 0,11 % | ||
| CVE-2026-98161 Błąd w jądrze Linux pozwala na zapis danych mimo nieudanej operacji PREFLUSH, co może prowadzić do utraty danych. |
Pozostałe |
CVSS 5,5EPSS 0,11 % | ||
| CVE-2026-98162 Wyciekanie połączeń w kernelu Linux w funkcji smb2_tree_connect może prowadzić do wyczerpania zasobów. |
Pozostałe |
CVSS 5,5EPSS 0,11 % | ||
| CVE-2026-97222 A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can dereference a freed… |
Pozostałe |
CVSS 5,5EPSS 0,12 % | ||
| CVE-2026-80430 Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to… |
Pozostałe |
CVSS 4,6EPSS 0,16 % | ||
| CVE-2026-80431 Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a… |
Pozostałe |
CVSS 6,8EPSS 0,13 % | ||
| CVE-2026-84893 IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the… |
Pozostałe |
CVSS 6,5EPSS 0,19 % | ||
| CVE-2026-100177 The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled… |
Pozostałe |
CVSS 6,3EPSS 0,34 % | ||
| CVE-2026-100187 The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (exactly 69… |
Pozostałe |
CVSS 6,9EPSS 0,43 % | ||
| CVE-2026-100190 The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS). User-supplied data originating from imported crawler… |
Pozostałe |
CVSS 6,3EPSS 0,32 % | ||
| CVE-2026-100174 The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS). A user with the ability to create a custom tag could embed an HTML… |
Pozostałe |
CVSS 5,1EPSS 0,4 % | ||
| CVE-2026-100079 Błąd w jądrze Linuxa pozwala na pozostawienie wpisów debugfs po wyrejestrowaniu, co może prowadzić do konfliktów. |
Pozostałe |
CVSS 5,5EPSS 0,11 % | ||
| CVE-2026-100076 Wycieki pamięci w sterowniku RTL8723BS mogą prowadzić do wyczerpania zasobów i braku możliwości wysyłania ramek. |
Pozostałe |
CVSS 5,5EPSS 0,16 % | ||
| CVE-2026-100077 Błąd w jądrze Linuxa pozwalał na wystąpienie błędów GPU podczas odzyskiwania, co mogło prowadzić do awarii. |
Pozostałe |
CVSS 5,5EPSS 0,16 % | ||
| CVE-2026-100078 Błąd w jądrze Linux w iwlwifi umożliwia nieprawidłowe przekazywanie argumentów, co może prowadzić do awarii. |
Pozostałe |
CVSS 5,5EPSS 0,11 % | ||
| CVE-2026-100070 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_addr() changes the packet… |
Pozostałe |
CVSS 5,5EPSS 0,11 % | ||
| CVE-2026-100071 In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler… |
Pozostałe |
CVSS 5,5EPSS 0,11 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 5.11.2026, 19:02 UTC – 6.11.2026, 00:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.