KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing…
A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a…
A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is…
A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without…
A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous…
A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected from API filtering, its recipient value is copied in clear text…
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which checks only the management tag, instead of is_authorized_vhost/2. The…
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from…
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size.…
A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the…
Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.
Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.
Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.
Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.
Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.
Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.
Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.
Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.
Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.
Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.
Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-84717 A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for… |
Pozostałe |
CVSS 5,3EPSS 0,34 % | ||
| CVE-2026-84718 A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the… |
Pozostałe |
CVSS 4,3EPSS 0,14 % | ||
| CVE-2026-84720 A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats artifacts… |
Pozostałe |
CVSS 6,5EPSS 0,27 % | ||
| CVE-2026-84721 A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and… |
Pozostałe |
CVSS 6,4EPSS 0,29 % | ||
| CVE-2026-84712 A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes… |
Pozostałe |
CVSS 5,3EPSS 0,39 % | ||
| CVE-2026-84713 A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected from API… |
Pozostałe |
CVSS 6,5EPSS 0,44 % | ||
| CVE-2026-66076 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which checks only the… |
Pozostałe |
CVSS 6,5EPSS 0,33 % | ||
| CVE-2026-67238 RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls… |
Pozostałe |
CVSS 6,5EPSS 0,39 % | ||
| CVE-2026-96545 An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an… |
Pozostałe |
CVSS 4,4EPSS 0,18 % | ||
| CVE-2026-96548 A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resources/jdbc.properties. This… |
Pozostałe |
CVSS 5,6EPSS 0,42 % | ||
| CVE-2026-95600 Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions. |
Pozostałe |
CVSS 5,3EPSS 0,33 % | ||
| CVE-2026-95602 Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue… |
Pozostałe |
CVSS 6,5EPSS 0,36 % | ||
| CVE-2026-95530 Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions. |
Pozostałe |
CVSS 6,5EPSS 0,22 % | ||
| CVE-2026-95586 Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions. |
Pozostałe |
CVSS 6,5EPSS 0,22 % | ||
| CVE-2026-95592 Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions. |
Pozostałe |
CVSS 5,3EPSS 0,31 % | ||
| CVE-2026-95514 Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions. |
Pozostałe |
CVSS 5,3EPSS 0,33 % | ||
| CVE-2026-95523 Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. |
Pozostałe |
CVSS 6,5EPSS 0,34 % | ||
| CVE-2026-95524 Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. |
Pozostałe |
CVSS 5,3EPSS 0,33 % | ||
| CVE-2026-95525 Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions. |
Pozostałe |
CVSS 6,5EPSS 0,47 % | ||
| CVE-2026-95527 Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions. |
Pozostałe |
CVSS 6,5EPSS 0,33 % | ||
| CVE-2026-94671 Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. |
Pozostałe |
CVSS 6,5EPSS 0,22 % | ||
| CVE-2026-94679 Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions. |
Pozostałe |
CVSS 5,4EPSS 0,23 % | ||
| CVE-2026-94680 Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. |
Pozostałe |
CVSS 6,5EPSS 0,22 % | ||
| CVE-2026-94682 Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions. |
Pozostałe |
CVSS 6,5EPSS 0,22 % | ||
| CVE-2026-94391 Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions. |
Pozostałe |
CVSS 6,5EPSS 0,22 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 6.11.2026, 11:02 UTC – 6.11.2026, 16:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.