Publikacje w kolejności czasu
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Online Music Site | CVE-2026-1535 A security vulnerability has been detected in code-projects Online Music Site 1.0. This impacts an unknown function of the file /Administrator/PHP/AdminReply.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been… |
9,8 | 0,46 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Online Music Site | CVE-2026-1533 A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminAddCategory.php. The manipulation results in sql injection. The attack may be performed from remote. The exploit has been released to the… |
9,8 | 0,4 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-69602 A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful authentication. As a result, the same session cookie value is reused for users logging in from the same browser, allowing an attacker who… |
9,1 | 0,39 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Web Help Desk | SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication. |
9,8 | 84,18 % | Tak | |
| Web Help Desk | CVE-2025-40552 SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication. |
9,8 | 52 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Web Help Desk | CVE-2025-40553 SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication. |
9,8 | 67,98 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Web Help Desk | CVE-2025-40554 SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk. |
9,8 | 60,64 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Web Help Desk | SolarWinds Web Help Desk Security Control Bypass Vulnerability SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality. |
9,8 | 73,56 % | Tak | |
| dokploy | CVE-2026-24841 Wstrzyknięcie poleceń w Dokploy umożliwia zdalne wykonanie kodu na serwerze. |
9,9 | 2,79 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| SandboxJS | CVE-2026-23830 SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Function` constructor with a safe, sandboxed version… |
10,0 | 1,22 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| ragflow | CVE-2026-24770 Wykorzystanie podatności Zip Slip w RAGFlow pozwala na zdalne wykonanie kodu przez nadpisanie plików. |
9,8 | 1,43 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| dozzle | CVE-2026-24740 Luka w Dozzle pozwala na uzyskanie interaktywnego dostępu do kontenerów poza zakresem. |
9,9 | 0,42 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| FortiWeb / FortiNAC-F / FortiOS (+3 produktów) | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability Obejście uwierzytelnienia w Fortinet FortiAnalyzer umożliwia dostęp do obcych urządzeń. |
9,8 | 86,59 % | Tak | |
| GnuPG | CVE-2026-24881 Przepełnienie bufora w GnuPG umożliwia zdalne wykonanie kodu lub atak typu denial of service. |
9,8 | 1,81 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| kyverno | CVE-2026-22039 Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have a critical authorization boundary bypass in namespaced Kyverno Policy apiCall. The resolved `urlPath` is executed using the Kyverno admission controller ServiceAccount, with no… |
9,9 | 0,58 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-69564 code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExAddNewUser.php via the Name, Address, email, UserName, Password, confirm_password, Role, Branch, and Activate parameters. |
9,8 | 0,48 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-69559 code-projects Computer Book Store 1.0 is vulnerable to File Upload in admin_add.php. |
9,8 | 0,6 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-69562 code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /insertmessage.php via the userid parameter. |
9,8 | 0,53 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-69563 code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExLogin.php via the Password parameter. |
9,8 | 0,53 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-69565 code-projects Mobile Shop Management System 1.0 is vulnerable to File Upload in /ExAddProduct.php. |
9,8 | 0,5 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| OpenSSL | CVE-2025-15467 Przepełnienie bufora w OpenSSL przy przetwarzaniu danych CMS może prowadzić do awarii usługi lub zdalnego wykonania kodu. |
9,8 | 74,79 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| n8n | CVE-2026-1470 n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An… |
9,9 | 20,4 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| vm2 | CVE-2026-22709 vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of… |
10,0 | 1,27 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Online Music Site | CVE-2026-1443 A flaw has been found in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP/AdminDeleteUser.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and… |
9,8 | 0,55 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Microsoft 365 Apps for Enterprise / Microsoft Office 2016 / Microsoft Office 2019 (+2 produktów) | Microsoft Office Security Feature Bypass Vulnerability Zaufanie do niezweryfikowanych danych w Microsoft Office pozwala lokalnie obejść funkcję zabezpieczeń. |
7,8 | 70,82 % | Tak |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 15.11.2026, 07:02 UTC – 15.11.2026, 12:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.