Publikacje w kolejności czasu
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| ESS Excelity | CVE-2026-73642 Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4. |
9,2 | 0,42 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| ESS Excelity | CVE-2026-73640 Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in… |
9,3 | 0,29 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| ADC / Gateway | Citrix NetScaler Improper Input Validation Vulnerability Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. |
9,8 | 81,89 % | Tak | |
| ADC / Gateway | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service |
8,1 | 76,57 % | Tak | |
| Media Server | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with… |
5,3 | 11,89 % | Tak | |
| Media Server | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. |
6,9 | 12,69 % | Tak | |
| Media Server | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and… |
5,3 | 10,72 % | Tak | |
| Media Server | Plex Media Server External Control of File Name or Path Vulnerability Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. |
8,6 | 19,77 % | Tak | |
| moquette | CVE-2026-95848 Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to… |
9,1 | 0,42 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| moquette | CVE-2026-85724 Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses… |
9,6 | 0,32 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| mcp-atlassian | CVE-2026-77254 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network… |
9,1 | 0,62 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| mcp-atlassian | CVE-2026-77244 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence… |
10,0 | 0,35 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| WordPress | WordPress Core Remote File Inclusion Vulnerability WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. |
8,1 | 95,77 % | Tak | |
| BIG-IP | F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution. |
9,3 | 26,55 % | Tak | |
| Quantum Security Management | Check Point Multiple Products Path Traversal Vulnerability Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts. |
9,8 | 91,61 % | Tak | |
| VeloCloud Orchestrator (VCO) On-Prem | Arista VeloCloud Orchestrator Improper Input Validation Vulnerability Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the… |
9,5 | 1,38 % | Tak | |
| suricata | CVE-2026-57228 Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split… |
9,1 | 0,42 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Acronis Backup plugin for cPanel & WHM / Acronis Backup extension for Plesk / Acronis Backup plugin for DirectAdmin | Acronis Backup Incorrect Default Permissions Vulnerability Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation. |
7,8 | 0,23 % | Tak | |
| Cisco Identity Services Engine Software / Cisco ISE Passive Identity Connector | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. |
10,0 | 75,6 % | Tak | |
| T-Mobile 5G Box IDU | CVE-2026-58147 WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters, allowing an authenticated attacker… |
9,3 | 1,58 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| T-Mobile 5G Box IDU | CVE-2026-58146 WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the cli_cookie POST parameter. The cli_cookie parameter value is directly concatenated into a find command string without… |
9,4 | 2,89 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Android | Google Pixel Improper Authorization Vulnerability Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. |
8,8 | 0,63 % | Tak | |
| FreeRDP | CVE-2026-91949 FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS… |
9,2 | 0,58 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Cisco Secure Email | Cisco Secure Email Gateway SQL Injection Vulnerability Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. |
9,8 | 40,16 % | Tak | |
| GitLab | GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability Nieautoryzowany użytkownik w GitLab może odczytać dowolne pliki z serwera. |
10,0 | 97,36 % | Tak |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 14.11.2026, 23:02 UTC – 15.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.