Publikacje w kolejności czasu
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Cisco Secure Firewall Adaptive Security Appliance (ASA) Software / Cisco Secure Firewall Threat Defense (FTD) Software | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. |
8,6 | 0,82 % | Tak | |
| Wing FTP Server | CVE-2026-105420 Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner… |
9,4 | 0,52 % | Brak wpisu w KEV nie wyklucza ataków | |
| Sid Meier's Civilization VI | CVE-2026-116370 A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the… |
9,6 | 0,39 % | Brak wpisu w KEV nie wyklucza ataków | |
| Civilization V | CVE-2026-116111 A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The… |
9,6 | 0,3 % | Brak wpisu w KEV nie wyklucza ataków | |
| CGM CLININET | CVE-2025-30054 CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these… |
9,3 | 0,1 % | Brak wpisu w KEV nie wyklucza ataków | |
| CGM CLININET | CVE-2025-30047 CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this… |
9,4 | 0,38 % | Brak wpisu w KEV nie wyklucza ataków | |
| authlib | CVE-2026-114615 Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed… |
9,1 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| authlib | CVE-2026-114616 Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can… |
9,1 | 0,3 % | Brak wpisu w KEV nie wyklucza ataków | |
| VeloCloud Orchestrator | Arista VeloCloud Orchestrator SQL Injection Vulnerability Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data… |
9,4 | 1,03 % | Tak | |
| Brotli | Google Brotli Unchecked Return Value Vulnerability Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. |
9,8 | 82,64 % | Tak | |
| PHP | PHP Memory Corruption Vulnerability PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. |
9,8 | > 99,99 % | Tak | |
| PHP | PHP Stale Internal Request-State Vulnerability PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. |
8,1 | > 99,99 % | Tak | |
| Chrome | CVE-2026-113263 Missing authorization in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
9,6 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| Pillow | CVE-2026-112900 Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a… |
9,8 | 1,3 % | Brak wpisu w KEV nie wyklucza ataków | |
| Pillow | CVE-2026-112398 Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four… |
9,8 | 0,7 % | Brak wpisu w KEV nie wyklucza ataków | |
| Pillow | CVE-2026-112403 Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3… |
9,8 | 0,95 % | Brak wpisu w KEV nie wyklucza ataków | |
| Pillow | CVE-2026-112393 Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation from the prior… |
9,8 | 1,02 % | Brak wpisu w KEV nie wyklucza ataków | |
| Webtop Media Transcoder | Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. |
4,3 | 0,64 % | Tak | |
| FreeRDP | CVE-2026-111375 FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that… |
9,1 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| Connect Secure | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527. |
7,0 | 0,53 % | Tak | |
| Remote Support | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. |
9,8 | 79,49 % | Tak | |
| Siemens Software Center | Siemens Software Center Uncontrolled Search Path Element Vulnerability Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. |
8,4 | 0,97 % | Tak | |
| PAN-OS | Palo Alto Networks PAN-OS Code Injection Vulnerability Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. |
7,2 | 2,15 % | Tak | |
| Cisco Secure Email | Cisco Secure Email Gateway Relative Path Traversal Vulnerability Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. |
9,8 | 6,23 % | Tak | |
| SiteGuard Server Edition for Apache httpd / SiteGuard Server Edition for Nginx / SiteGuard Server Edition for IIS (+2 produktów) | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. |
8,5 | 2,53 % | Tak |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 14.11.2026, 23:02 UTC – 15.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.