Publikacje w kolejności czasu
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| FortiOS | CVE-2026-126259 A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super… |
9,8 | 0,65 % | Brak wpisu w KEV nie wyklucza ataków | |
| FortiAnalyzer / FortiManager | CVE-2026-126262 A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0… |
9,8 | 0,63 % | Brak wpisu w KEV nie wyklucza ataków | |
| FortiMail | CVE-2026-126263 A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6 may allow an authenticated attacker to execute unauthorized code or commands via specifically… |
9,8 | 0,44 % | Brak wpisu w KEV nie wyklucza ataków | |
| FortiAuthenticator | CVE-2026-126251 A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. |
9,1 | 0,6 % | Brak wpisu w KEV nie wyklucza ataków | |
| FortiOS | CVE-2026-126253 A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker to broadcast LSA via specially crafted request |
9,3 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| FortiOS | CVE-2026-126254 A numeric truncation error vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a configured ibgp neighbor to send malicious/malformed attributes to all connected routers via a specially crafted… |
9,6 | 0,47 % | Brak wpisu w KEV nie wyklucza ataków | |
| FortiAuthenticator | CVE-2026-126257 A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access. |
9,0 | 0,4 % | Brak wpisu w KEV nie wyklucza ataków | |
| FortiManager / FortiAnalyzer / FortiManager Cloud (+1 produktów) | CVE-2026-126229 A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud… |
9,1 | 0,63 % | Brak wpisu w KEV nie wyklucza ataków | |
| FortiManager / FortiAnalyzer / FortiManager Cloud (+2 produktów) | CVE-2026-126170 A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2,… |
9,8 | 0,63 % | Brak wpisu w KEV nie wyklucza ataków | |
| FortiMail | CVE-2026-126164 A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized… |
9,4 | 0,45 % | Brak wpisu w KEV nie wyklucza ataków | |
| FortiMail | CVE-2026-126155 A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or… |
9,1 | 0,66 % | Brak wpisu w KEV nie wyklucza ataków | |
| FortiMail | CVE-2026-126156 A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via… |
9,1 | 0,65 % | Brak wpisu w KEV nie wyklucza ataków | |
| FortiMail | CVE-2026-126157 A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to gain access to other users' secure email accounts via crafted HTTP requests. |
9,1 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków | |
| FortiMail | CVE-2026-126148 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets. |
9,8 | 2,45 % | Brak wpisu w KEV nie wyklucza ataków | |
| FortiMail | CVE-2026-126150 A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take… |
9,1 | 0,51 % | Brak wpisu w KEV nie wyklucza ataków | |
| FortiMail | CVE-2026-126147 A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or… |
9,8 | 0,63 % | Brak wpisu w KEV nie wyklucza ataków | |
| blueprintue-self-hosted-edition | CVE-2026-126812 blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root… |
9,3 | 0,6 % | Brak wpisu w KEV nie wyklucza ataków | |
| AVideo | CVE-2026-126806 WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source… |
9,3 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| NextScan | CVE-2026-126797 NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full… |
9,8 | 0,62 % | Brak wpisu w KEV nie wyklucza ataków | |
| @hydrooj/ui-default | CVE-2026-126800 Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when… |
9,3 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| fider | CVE-2026-65840 Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and… |
9,6 | 0,3 % | Brak wpisu w KEV nie wyklucza ataków | |
| Traccar | CVE-2026-126777 Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in… |
9,1 | 0,46 % | Brak wpisu w KEV nie wyklucza ataków | |
| REMS | CVE-2026-126768 OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and… |
9,3 | 0,77 % | Brak wpisu w KEV nie wyklucza ataków | |
| quay / Red Hat Quay 3.10 / Red Hat Quay 3.12 (+8 produktów) | CVE-2026-110697 A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their… |
9,9 | 0,74 % | Brak wpisu w KEV nie wyklucza ataków | |
| WooCommerce Virtual POS Module | CVE-2026-85632 Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle. This issue… |
9,1 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 14.11.2026, 23:02 UTC – 15.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.