KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through tool_ids, skill_tool_ids, or mcp_tool_ids…
MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id in the request path, then query the target Document by document_id or Paragraph by paragraph_id…
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP tool_id in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the…
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the is_permanent and expire_time checks used by the…
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's application_id from the homepage application question-ranking endpoint when the published victim application has…
Obejście zabezpieczeń w Envoy pozwala na dostęp do chronionych zasobów.
Błąd normalizacji URL w Envoy umożliwia obejście polityki bezpieczeństwa przez zdalnego klienta.
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-backtracking pattern…
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without…
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST /api/transcribe/:id handlers in packages/server/src/routes/api/transcribe.ts on Joplin Server…
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied…
web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/controllers/webservices.py).
Stencil core 4.43.5 is vulnerable to Incorrect Access Control.
Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of…
Błąd w Envoy powoduje awarię procesu przy przetwarzaniu adresów IPv6 w niektórych warunkach.
Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed…
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirect_uri parameter but leaves tab,…
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP,…
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that…
Przepełnienie wskaźnika w Envoy może prowadzić do awarii pracownika serwera.
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletter_config.html into a JavaScript string without safe JSON…
Błąd w Envoy powoduje awarię procesu przez użycie po zwolnieniu pamięci.
jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite…
jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data…
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-77516 MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still… |
Pozostałe |
CVSS 5,4EPSS 0,24 % | ||
| CVE-2026-77517 MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id in the request path, then… |
Pozostałe |
CVSS 5,4EPSS 0,23 % | ||
| CVE-2026-77518 MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP tool_id in the same workspace can retrieve the… |
Pozostałe |
CVSS 5,0EPSS 0,27 % | ||
| CVE-2026-77519 MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status,… |
Pozostałe |
CVSS 5,4EPSS 0,24 % | ||
| CVE-2026-77520 MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's application_id from the homepage application… |
Pozostałe |
CVSS 5,4EPSS 0,23 % | ||
| CVE-2026-73511 Obejście zabezpieczeń w Envoy pozwala na dostęp do chronionych zasobów. |
PozostałePubliczny PoC |
CVSS 5,3EPSS 0,38 % | ||
| CVE-2026-73551 Błąd normalizacji URL w Envoy umożliwia obejście polityki bezpieczeństwa przez zdalnego klienta. |
Pozostałe |
CVSS 5,3EPSS 0,53 % | ||
| CVE-2026-58270 Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a… |
Pozostałe |
CVSS 6,5EPSS 0,41 % | ||
| CVE-2026-58272 Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint… |
Pozostałe |
CVSS 5,3EPSS 0,39 % | ||
| CVE-2026-59816 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST /api/transcribe/:id handlers… |
Pozostałe |
CVSS 4,3EPSS 0,36 % | ||
| CVE-2026-55179 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in… |
Pozostałe |
CVSS 6,5EPSS 0,26 % | ||
| CVE-2026-79318 web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/controllers/webservices.py). |
Pozostałe |
CVSS 6,5EPSS 0,56 % | ||
| CVE-2026-79319 Stencil core 4.43.5 is vulnerable to Incorrect Access Control. |
Pozostałe |
CVSS 5,3EPSS 0,21 % | ||
| CVE-2026-79320 Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and… |
Pozostałe |
CVSS 6,1EPSS 0,16 % | ||
| CVE-2026-73549 Błąd w Envoy powoduje awarię procesu przy przetwarzaniu adresów IPv6 w niektórych warunkach. |
Pozostałe |
CVSS 5,3EPSS 0,62 % | ||
| CVE-2026-62247 Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read… |
Pozostałe |
CVSS 6,5EPSS 0,45 % | ||
| CVE-2026-54915 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes… |
Pozostałe |
CVSS 5,4EPSS 0,26 % | ||
| CVE-2026-58271 Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code… |
Pozostałe |
CVSS 6,8EPSS 0,22 % | ||
| CVE-2026-45381 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in… |
Pozostałe |
CVSS 5,1EPSS 0,57 % | ||
| CVE-2026-48521 Przepełnienie wskaźnika w Envoy może prowadzić do awarii pracownika serwera. |
PozostałePubliczny PoC |
CVSS 5,9EPSS 0,74 % | ||
| CVE-2026-49995 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by… |
Pozostałe |
CVSS 4,8EPSS 0,6 % | ||
| CVE-2026-50572 Błąd w Envoy powoduje awarię procesu przez użycie po zwolnieniu pamięci. |
Pozostałe |
CVSS 5,9EPSS 0,68 % | ||
| CVE-2026-94414 jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers… |
Pozostałe |
CVSS 5,4EPSS 0,38 % | ||
| CVE-2026-94494 jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate… |
Pozostałe |
CVSS 5,3EPSS 0,37 % | ||
| CVE-2026-91166 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown… |
Pozostałe |
CVSS 5,7EPSS 0,22 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 7.11.2026, 19:02 UTC – 8.11.2026, 00:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.