Publikacje w kolejności czasu
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Agora Project | CVE-2026-63167 Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can… |
8,5 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| Agora Project | CVE-2026-63170 Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id() from predictable fields such as object creation time, which is self-disclosed through autorDate and… |
6,3 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| Agora Project | CVE-2026-63150 Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link… |
8,6 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| Agora Project | CVE-2026-63151 Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5(calendarId.userId), both small enumerable… |
8,7 | 0,42 % | Brak wpisu w KEV nie wyklucza ataków | |
| Agora Project | CVE-2026-63155 Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary external URLs by manipulating the objUrl parameter in Ctrl.php's redir() function. Attackers can craft login links with objUrl set to a malicious site,… |
5,3 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| Agora Project | CVE-2026-63164 Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php.… |
7,1 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| Agora Project | CVE-2026-63166 Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only… |
5,3 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| mrbs-code | CVE-2026-129132 MRBS before 1.13.0 contains an LDAP injection vulnerability in web/lib/MRBS/Auth/AuthLdap.php that interpolates unescaped login usernames into DN search and group-membership filters. Attackers with valid directory credentials outside the required group can submit crafted usernames that make the… |
4,2 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| mrbs-code | CVE-2026-129133 MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape() function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom… |
5,4 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| mrbs-code | CVE-2026-129134 MRBS before 1.13.0 contains a password reset poisoning vulnerability that allows unauthenticated attackers to redirect reset links by forging the Host header when $url_base is unset. Attackers can request a reset for a victim so AuthDb::notifyUser() emails a link pointing to their host, capturing… |
8,1 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| picoquic | CVE-2026-129135 picoquic before 2026.11.05.3e2e3d3 contains an integer overflow vulnerability in picoquic_decode_time_stamp_frame() that allows remote QUIC peers to corrupt stored timestamps by sending oversized TIME_STAMP values. Attackers on connections negotiating the TIME_STAMP extension can send large values… |
6,3 | 0,5 % | Brak wpisu w KEV nie wyklucza ataków | |
| SQLBot | CVE-2026-129127 SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sys_user.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrator passwords, using precomputed tables… |
5,9 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| goose | CVE-2026-129128 Goose CLI 1.35.0 before 1.53.0 contains a local code execution vulnerability that allows attackers to run commands by setting diff.external in a repository's .git/config. Attackers can ship a crafted repository that, when the victim runs goose review, executes git diff without --no-ext-diff,… |
7,8 | 0,15 % | Brak wpisu w KEV nie wyklucza ataków | |
| AiSOC | CVE-2026-129129 AiSOC 12.1.0 before 23.3.0 contains a missing authentication vulnerability that allows unauthenticated attackers to query the enrichment service through Next.js console rewrite routes. Attackers can send requests to /api/v1/enrichment/lookup or /api/v1/enrichment/bulk to retrieve… |
6,5 | 0,45 % | Brak wpisu w KEV nie wyklucza ataków | |
| agent-device | CVE-2026-129130 agent-device from 0.21.36 before 0.21.37 contains a local file disclosure vulnerability that allows authenticated remote callers to read daemon-host files by opening file:// URLs. Attackers can send an open command with a file:// target through /rpc, then issue snapshot to read any plaintext file… |
6,5 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| gameyfin | CVE-2026-129131 Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which… |
6,9 | 0,43 % | Brak wpisu w KEV nie wyklucza ataków | |
| C-Kermit | CVE-2026-129120 C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers to write unrequested files without prompting by abusing recursive GET root computation in ckcfns.c. Attackers can send files such as .ssh/authorized_keys or shell startup files… |
5,3 | 0,39 % | Brak wpisu w KEV nie wyklucza ataków | |
| C-Kermit | CVE-2026-129121 C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget() in ckcftp.c that allows malicious FTP servers to write files outside the intended directory. Attackers can return absolute paths, tilde names, or dot-dot components in NLST or MLSD listings during MGET… |
6,5 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków | |
| C-Kermit | CVE-2026-129122 C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tn_snenv() in ckctel.c that allows malicious Telnet servers to corrupt client memory via crafted NEW-ENVIRON SEND subnegotiation. Malicious or machine-in-the-middle servers can send oversized variable names before… |
7,5 | 0,46 % | Brak wpisu w KEV nie wyklucza ataków | |
| C-Kermit | CVE-2026-129123 C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or… |
8,7 | 0,6 % | Brak wpisu w KEV nie wyklucza ataków | |
| C-Kermit | CVE-2026-129124 C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing… |
8,1 | 1,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| C-Kermit | CVE-2026-129125 C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell commands on servers with host commands disabled by abusing REMOTE QUERY evaluation. Attackers can send a REMOTE QUERY invoking the command function, or define a macro via REMOTE… |
8,1 | 0,68 % | Brak wpisu w KEV nie wyklucza ataków | |
| C-Kermit | CVE-2026-129126 C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious peers to write past the srvcmd buffer by sending crafted packets. Attackers can use Kermit repeat-count compression in server command, GET, or file-header packets to write… |
8,1 | 0,6 % | Brak wpisu w KEV nie wyklucza ataków | |
| Eclipse BaSyx Go Components | CVE-2026-128986 In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access… |
6,0 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| C-Kermit | CVE-2026-129116 C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTH_VALID after a refused certificate login. Attackers holding a trusted certificate mapped to a refused account can log in as any other account… |
7,5 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 14.11.2026, 23:02 UTC – 15.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.