Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration file containing the hashed password of the administrative account. Successful exploitation of this…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to them. The create and update endpoints of the server API, however, stored the "shared" flag and shared username they were sent, so any user able to register a…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
CVE-2026-97717
is a vulnerability in the proxy sub-system of Secure Access servers prior to
14.60. Authenticated attackers can send malformed data to the server and cause
a persistent denial of service.
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Protection mechanism failure for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data exposure. This…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.22.5, a Heap-Use-After-Free (UAF) vulnerability exists in the TCP transport component of NanoMQ, which relies on the underlying NanoNNG library (specifically in src/sp/transport/mqtt/broker_tcp.c). The…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
CVSS
6,0
EPSS
0,22 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration file containing the hashed password of the administrative account. Successful exploitation of this…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to them. The create and update endpoints of the server API, however, stored the "shared" flag and shared username they were sent, so any user able to register a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
CVE-2026-97717
is a vulnerability in the proxy sub-system of Secure Access servers prior to
14.60. Authenticated attackers can send malformed data to the server and cause
a persistent denial of service.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Protection mechanism failure for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data exposure. This…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.22.5, a Heap-Use-After-Free (UAF) vulnerability exists in the TCP transport component of NanoMQ, which relies on the underlying NanoNNG library (specifically in src/sp/transport/mqtt/broker_tcp.c). The…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
6,0
0,22 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.