Publikacje w kolejności czasu
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| SemanticMediaWiki | CVE-2026-126566 Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userMayChangeProtection() that checks protection changes against the page's latest revision author. Editors can add {{#set:Is edit protected=false}} to a transcluded template, removing… |
7,1 | 0,39 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-126567 Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped native_result and score_set output. Attackers can store markup in a Text property or subobject… |
5,1 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| mbin | CVE-2026-126569 Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that renders nested Markdown image alt text and URL without HTML escaping. Authenticated users can embed HTML in the alt text of an image inside a link in entries, comments, posts,… |
5,1 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| padloc | CVE-2026-126570 Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or constructor.prototype.x passed to setPath() to… |
7,0 | 0,42 % | Brak wpisu w KEV nie wyklucza ataków | |
| padloc | CVE-2026-126571 Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification… |
6,3 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-126561 Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set it in widely transcluded templates, so… |
7,1 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-126562 Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion vulnerability in the ElasticStore ConceptDescriptionInterpreter that only detects directly self-referencing concepts. Users with page-edit rights can create mutually referencing concept pages, causing concept page views,… |
5,3 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-126563 Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat(), which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Special:Ask URL with HTML markup in a date printout… |
5,3 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-126564 Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::getFormattedSubject() that renders property label segments after a literal as unescaped markup. Users with page-edit rights can set a preferred property label containing an img… |
5,1 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-126565 Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of service vulnerability in the ElasticStore and SPARQLStore ConceptDescriptionInterpreter classes, which re-expand concepts without memoization or an expansion budget. Users with page-edit rights can build acyclic chains of Concept: pages… |
5,3 | 0,38 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-126559 Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles() that allows users with the smw-schemaedit right to inject markup. Attackers can save FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels that break out of option elements,… |
4,8 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-126560 Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables integration that initialises author-written smw-datatable tables unchanged. Users with page-edit rights can add HTML entity-encoded markup in data-search or data-filter cell attributes,… |
5,1 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| LimeSurvey Community Edition | CVE-2026-116645 LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named… |
7,1 | 0,3 % | Brak wpisu w KEV nie wyklucza ataków | |
| AVideo | CVE-2026-126545 WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and… |
5,3 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| Viber for iOS | CVE-2026-126546 Viber for iOS through 29.4.0.24 fails to validate the logical screen width and height in received GIF headers, allowing attackers to crash the app. Attackers can send a crafted GIF with zero dimensions that triggers an uncaught NSInternalInconsistencyException, aborting the app with SIGABRT when… |
5,3 | 0,3 % | Brak wpisu w KEV nie wyklucza ataków | |
| directus | CVE-2026-126539 Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then… |
9,2 | 0,46 % | Brak wpisu w KEV nie wyklucza ataków | |
| AVideo | CVE-2026-126541 WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary live_transmitions_history_id values. Attackers can redeem the issued action tokens at… |
8,6 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| AVideo | CVE-2026-126542 WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email,… |
9,3 | 0,75 % | Brak wpisu w KEV nie wyklucza ataków | |
| AVideo | CVE-2026-126543 WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal… |
8,7 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| AVideo | CVE-2026-126544 WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with… |
5,3 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| MQTTX | CVE-2026-126495 MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subscribed topics can execute script in the… |
5,3 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| CordysCRM | CVE-2026-126496 1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read… |
5,3 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| LibreCAD | CVE-2026-126497 LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to… |
8,5 | 0,17 % | Brak wpisu w KEV nie wyklucza ataków | |
| WriteFreely | CVE-2026-126498 WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated authors to inject HTML by supplying a malicious post slug via the CreatePost API. The raw slug is concatenated into an anchor by augmentReadingDestination() for paid-shortcode posts, executing… |
5,1 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| jellyfin | CVE-2026-126499 Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can supply names like .. or absolute paths… |
8,3 | 0,49 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 15.11.2026, 11:02 UTC – 15.11.2026, 16:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.