CVE-2026-25262
Uszkodzenie pamięci podczas przetwarzania spreparowanego pliku ELF w Primary Bootloader prowadzi do zdalnego wykonania kodu.
PozostałeSkrót PL
- CVSS
- 6,3
- EPSS
- 0,14 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
KATALOG PODATNOŚCI
Dotkliwość: Średnia
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
CVE-2026-15095
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for…
PozostałeOpis źródłowy · EN
- CVSS
- 4,9
- EPSS
- 1,04 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-9004
The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with…
PozostałeOpis źródłowy · EN
- CVSS
- 4,3
- EPSS
- 0,37 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-95503
A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center…
PozostałeOpis źródłowy · EN
- CVSS
- 6,8
- EPSS
- 0,19 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-91092
The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated…
PozostałeOpis źródłowy · EN
- CVSS
- 4,3
- EPSS
- 0,39 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-74765
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation…
PozostałeOpis źródłowy · EN
- CVSS
- 6,5
- EPSS
- 0,33 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-7622
The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the send_deactivation_survey() function registered via the…
PozostałeOpis źródłowy · EN
- CVSS
- 4,3
- EPSS
- 0,35 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-1645
The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the 'locale_url' setting in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes…
PozostałeOpis źródłowy · EN
- CVSS
- 4,4
- EPSS
- 0,31 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-18439
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id,…
PozostałeOpis źródłowy · EN
- CVSS
- 4,3
- EPSS
- 0,43 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-4123
The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the toggle_cache() function which is hooked to the wp_ajax_toggle_cache AJAX…
PozostałeOpis źródłowy · EN
- CVSS
- 4,3
- EPSS
- 0,35 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-16778
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and…
PozostałeOpis źródłowy · EN
- CVSS
- 6,4
- EPSS
- 0,38 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-18345
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and including, 2.9.18. The function is registered on the admin_init hook…
PozostałeOpis źródłowy · EN
- CVSS
- 4,3
- EPSS
- 0,34 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2025-1280
The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level…
PozostałeOpis źródłowy · EN
- CVSS
- 6,5
- EPSS
- 0,79 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-12995
The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the edit_meta_value due to missing validation on a user controlled key. This makes it possible for authenticated…
PozostałeOpis źródłowy · EN
- CVSS
- 4,3
- EPSS
- 0,37 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2025-14484
The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,32 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2025-14486
The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys (Pixabay,…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,32 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2025-14487
The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,32 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-85653
The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'other_attributes' Block Parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it…
PozostałeOpis źródłowy · EN
- CVSS
- 6,4
- EPSS
- 0,42 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-88788
The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level…
PozostałeOpis źródłowy · EN
- CVSS
- 6,8
- EPSS
- 0,43 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-93655
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to, and including, 11.8.3 due to insufficient input sanitization and output escaping. This makes it possible for…
PozostałeOpis źródłowy · EN
- CVSS
- 6,1
- EPSS
- 0,37 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-94491
A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/search_list.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has…
PozostałeOpis źródłowy · EN
- CVSS
- 5,5
- EPSS
- 0,41 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-93709
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,45 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-93711
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server…
PozostałeOpis źródłowy · EN
- CVSS
- 6,5
- EPSS
- 0,37 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-76974
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,35 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-94625
vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing…
PozostałeOpis źródłowy · EN
- CVSS
- 6,9
- EPSS
- 0,52 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-25262 Uszkodzenie pamięci podczas przetwarzania spreparowanego pliku ELF w Primary Bootloader prowadzi do zdalnego wykonania kodu. |
Pozostałe |
CVSS 6,3EPSS 0,14 % | ||
| CVE-2026-15095 The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and… |
Pozostałe |
CVSS 4,9EPSS 1,04 % | ||
| CVE-2026-9004 The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id'… |
Pozostałe |
CVSS 4,3EPSS 0,37 % | ||
| CVE-2026-95503 A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the… |
Pozostałe |
CVSS 6,8EPSS 0,19 % | ||
| CVE-2026-91092 The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying that a user is… |
Pozostałe |
CVSS 4,3EPSS 0,39 % | ||
| CVE-2026-74765 Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. The XS backend keeps the punycode delta,… |
Pozostałe |
CVSS 6,5EPSS 0,33 % | ||
| CVE-2026-7622 The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the… |
Pozostałe |
CVSS 4,3EPSS 0,35 % | ||
| CVE-2026-1645 The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the 'locale_url' setting in all versions up to, and including, 1.1.8… |
Pozostałe |
CVSS 4,4EPSS 0,31 % | ||
| CVE-2026-18439 The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the… |
Pozostałe |
CVSS 4,3EPSS 0,43 % | ||
| CVE-2026-4123 The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the… |
Pozostałe |
CVSS 4,3EPSS 0,35 % | ||
| CVE-2026-16778 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content in all versions up… |
Pozostałe |
CVSS 6,4EPSS 0,38 % | ||
| CVE-2026-18345 The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and… |
Pozostałe |
CVSS 4,3EPSS 0,34 % | ||
| CVE-2025-1280 The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This… |
Pozostałe |
CVSS 6,5EPSS 0,79 % | ||
| CVE-2026-12995 The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the edit_meta_value due to missing… |
Pozostałe |
CVSS 4,3EPSS 0,37 % | ||
| CVE-2025-14484 The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it… |
Pozostałe |
CVSS 5,3EPSS 0,32 % | ||
| CVE-2025-14486 The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible… |
Pozostałe |
CVSS 5,3EPSS 0,32 % | ||
| CVE-2025-14487 The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it… |
Pozostałe |
CVSS 5,3EPSS 0,32 % | ||
| CVE-2026-85653 The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'other_attributes' Block Parameter in all versions up to, and including, 4.4.1 due to… |
Pozostałe |
CVSS 6,4EPSS 0,42 % | ||
| CVE-2026-88788 The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a… |
Pozostałe |
CVSS 6,8EPSS 0,43 % | ||
| CVE-2026-93655 The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to, and including, 11.8.3 due to… |
Pozostałe |
CVSS 6,1EPSS 0,37 % | ||
| CVE-2026-94491 A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/search_list.jsp. Executing a manipulation of the argument address can lead to sql… |
Pozostałe |
CVSS 5,5EPSS 0,41 % | ||
| CVE-2026-93709 Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path… |
Pozostałe |
CVSS 5,3EPSS 0,45 % | ||
| CVE-2026-93711 Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name. A… |
Pozostałe |
CVSS 6,5EPSS 0,37 % | ||
| CVE-2026-76974 SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user,… |
Pozostałe |
CVSS 5,3EPSS 0,35 % | ||
| CVE-2026-94625 vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed.… |
Pozostałe |
CVSS 6,9EPSS 0,52 % |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 7.11.2026, 15:02 UTC – 7.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.
NVD · publikacjeOstatnie przetworzenie zakończone
NVD · aktualizacjeOstatnie przetworzenie zakończone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOstatnie przetworzenie zakończoneData modelu znajduje się przy rekordzie.