KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/course/btn_functions.php. This manipulation of the argument Course causes sql…
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests,…
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue…
A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to…
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user…
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated…
rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Join(drv.root, name) from the attacker-supplied…
Zapis tokenów uwierzytelniających w logach OpenPanel umożliwia przechwycenie danych przez atakujących.
Wstrzyknięcie SQL w OpenPanel umożliwia dostęp do metryk innych projektów.
Brak weryfikacji hasha sekretu klienta w OpenPanel pozwala na fałszowanie metryk przychodów.
The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This…
The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for…
The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. This is due to the AJAX…
The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it…
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the user_meta_save() function scalar…
The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for…
The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/…
The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated…
The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it possible for authenticated attackers, with contributor-level access and…
The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp…
The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-93959 A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/course/btn_func… |
Pozostałe |
CVSS 5,5EPSS 0,43 % | ||
| CVE-2026-94057 Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing. |
Pozostałe |
CVSS 5,3EPSS 0,2 % | ||
| CVE-2026-93989 vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply… |
Pozostałe |
CVSS 4,3EPSS 0,2 % | ||
| CVE-2026-94054 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write. |
Pozostałe |
CVSS 5,3EPSS 0,27 % | ||
| CVE-2026-94055 Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free. |
Pozostałe |
CVSS 5,3EPSS 0,29 % | ||
| CVE-2026-82672 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary… |
Pozostałe |
CVSS 6,3EPSS 0,52 % | ||
| CVE-2026-93999 A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server… |
Pozostałe |
CVSS 4,2EPSS 0,23 % | ||
| CVE-2026-94000 A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to… |
Pozostałe |
CVSS 6,6EPSS 0,4 % | ||
| CVE-2026-94001 A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for… |
Pozostałe |
CVSS 6,5EPSS 0,44 % | ||
| CVE-2026-93987 rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume.go computes a volume's… |
Pozostałe |
CVSS 4,6EPSS 0,15 % | ||
| CVE-2026-93982 Zapis tokenów uwierzytelniających w logach OpenPanel umożliwia przechwycenie danych przez atakujących. |
Pozostałe |
CVSS 4,8EPSS 0,17 % | ||
| CVE-2026-93983 Wstrzyknięcie SQL w OpenPanel umożliwia dostęp do metryk innych projektów. |
Pozostałe |
CVSS 5,3EPSS 0,33 % | ||
| CVE-2026-93984 Brak weryfikacji hasha sekretu klienta w OpenPanel pozwala na fałszowanie metryk przychodów. |
Pozostałe |
CVSS 6,9EPSS 0,42 % | ||
| CVE-2026-9613 The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not… |
Pozostałe |
CVSS 4,3EPSS 0,6 % | ||
| CVE-2026-9766 The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a… |
Pozostałe |
CVSS 4,3EPSS 0,4 % | ||
| CVE-2026-9858 The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipment, wxp_order_item_shipment,… |
Pozostałe |
CVSS 4,3EPSS 0,35 % | ||
| CVE-2026-1256 The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to… |
Pozostałe |
CVSS 6,4EPSS 0,35 % | ||
| CVE-2026-5410 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input… |
Pozostałe |
CVSS 6,4EPSS 0,38 % | ||
| CVE-2026-76579 The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input… |
Pozostałe |
CVSS 4,7EPSS 0,38 % | ||
| CVE-2026-8354 The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions up to, and including, 1.3.15 due to insufficient… |
Pozostałe |
CVSS 6,4EPSS 0,35 % | ||
| CVE-2026-9289 The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API… |
Pozostałe |
CVSS 5,3EPSS 0,62 % | ||
| CVE-2026-18346 The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is… |
Pozostałe |
CVSS 5,3EPSS 0,45 % | ||
| CVE-2026-9232 The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it… |
Pozostałe |
CVSS 6,5EPSS 0,48 % | ||
| CVE-2026-9615 The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and… |
Pozostałe |
CVSS 4,3EPSS 0,43 % | ||
| CVE-2026-9832 The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is… |
Pozostałe |
CVSS 5,3EPSS 0,56 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 8.11.2026, 07:02 UTC – 8.11.2026, 08:32 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.