Publikacje w kolejności czasu
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Produkt nieustalony | CVE-2025-69985 FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can… |
9,8 | 14,34 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Document Management System | CVE-2026-3069 A security vulnerability has been detected in itsourcecode Document Management System 1.0. Affected is an unknown function of the file /edtlbls.php. The manipulation of the argument field1 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may… |
9,8 | 0,38 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Document Management System | CVE-2026-3068 A weakness has been identified in itsourcecode Document Management System 1.0. This impacts an unknown function of the file /deluser.php. Executing a manipulation of the argument user2del can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the… |
9,8 | 0,38 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| pearProjectApi | CVE-2026-3057 A security flaw has been discovered in a54552239 pearProjectApi up to 2.8.10. Affected is the function dateTotalForProject of the file application/common/Model/Task.php of the component Backend Interface. The manipulation of the argument projectCode results in sql injection. The attack can be… |
9,8 | 0,59 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| dinky | CVE-2026-3053 A vulnerability was determined in DataLinkDC dinky up to 1.2.5. This affects the function addInterceptors of the file dinky-admin/src/main/java/org/dinky/configure/AppConfig.java of the component OpenAPI Endpoint. Executing a manipulation can lead to missing authentication. It is possible to… |
9,8 | 0,76 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| E-Logbook with Health Monitoring System for COVID-19 | CVE-2026-3046 A security vulnerability has been detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This vulnerability affects unknown code of the file /check_profile_old.php. The manipulation of the argument profile_id leads to sql injection. Remote exploitation of the attack is… |
9,8 | 0,38 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Event Management System | CVE-2026-3042 A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/index.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public… |
9,8 | 0,49 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-70327 TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable. The ip parameter is retrieved via websGetVar and passed to a ping command through CsteSystem without validating if the input starts with a… |
9,8 | 0,8 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Student Result Management System | CVE-2026-2983 A vulnerability was determined in SourceCodester Student Result Management System 1.0. The impacted element is an unknown function of the file /admin/core/import_users.php of the component Bulk Import. This manipulation of the argument File causes improper access controls. Remote exploitation of… |
9,8 | 0,48 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Camel | CVE-2026-23552 Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy… |
9,1 | 0,61 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Vaelsys | CVE-2026-2952 A flaw has been found in Vaelsys 4.1.0. This vulnerability affects unknown code of the file /tree/tree_server.php of the component HTTP POST Request Handler. This manipulation of the argument xajaxargs causes os command injection. The attack is possible to be carried out remotely. The exploit has… |
9,8 | 8,37 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| UJCMS | CVE-2026-2953 A vulnerability has been found in Dromara UJCMS 101.2. This issue affects the function deleteDirectory of the file WebFileTemplateController.delete of the component Template Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The exploit has been disclosed… |
9,1 | 0,88 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Online Store Management System ネット店舗管理システム | CVE-2026-2944 A security flaw has been discovered in Tosei Online Store Management System ネット店舗管理システム 1.01. Affected is the function system of the file /cgi-bin/monitor.php of the component HTTP POST Request Handler. Performing a manipulation of the argument DevId results in os command injection. The attack may… |
9,8 | 6,94 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Online Reviewer System | CVE-2026-2912 A vulnerability was found in code-projects Online Reviewer System 1.0. Impacted is an unknown function of the file /system/system/students/assessments/results/studentresult-view.php. The manipulation of the argument test_id results in sql injection. It is possible to launch the attack remotely.… |
9,8 | 0,38 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| funadmin | CVE-2026-2894 A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of the file app/frontend/view/login/forget.html. Such manipulation leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might… |
9,1 | 0,46 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| oneuptime | CVE-2026-27574 OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm module (explicitly documented as not a security mechanism) to execute user-supplied code, allowing trivial sandbox escape via a well-known… |
9,9 | 0,56 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Agri-Trading Online Shopping System | CVE-2026-2865 A vulnerability was found in itsourcecode Agri-Trading Online Shopping System 1.0. This impacts an unknown function of the file admin/productcontroller.php of the component HTTP POST Request Handler. Performing a manipulation of the argument Product results in sql injection. The attack may be… |
9,8 | 0,38 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| sail | CVE-2026-27168 SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. All versions are vulnerable to Heap-based Buffer Overflow through the XWD parser's use of the bytes_per_line value. The value os read directly from the file as the read size in… |
9,8 | 0,43 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| thesystem | CVE-2019-25441 thesystem 1.0 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the run_command endpoint. Attackers can send POST requests with shell commands in the command parameter to execute arbitrary code on… |
9,3 | 9,32 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| deno | CVE-2026-27190 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.6.8, a command injection vulnerability exists in Deno's node:child_process implementation. This vulnerability is fixed in 2.6.8. |
9,8 | 2,46 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Simple Responsive Tourism Website | CVE-2026-2848 A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=register of the component Registration. This manipulation of the argument Username causes sql injection. The attack may be… |
9,8 | 0,38 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-26747 A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.force_url" is not set and default is "false". The application generates absolute URLs… |
9,1 | 0,44 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-26722 An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to escalate privileges via PIN component of the login functionality. |
9,4 | 0,38 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-26725 Błąd w Print Shop Pro WebDesk umożliwia zdalnemu atakującemu eskalację uprawnień przez parametr AccessID. |
9,8 | 0,5 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| librenms | CVE-2026-26988 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically,… |
9,1 | 8,43 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 15.11.2026, 03:02 UTC – 15.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.