KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService…
Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0), digest updates are not subject to…
Brak limitów czasowych w HTTP/3 w Traefik umożliwia atak DoS przez nieautoryzowanych klientów.
Wtyczka CustomizeUser w WWBN AVideo umożliwia atak CSRF, co pozwala na fałszowanie liczby subskrybentów.
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::get_api_video()…
A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument…
Niespójne egzekwowanie limitu pamięci w Suricata pozwala na przekroczenie zabezpieczeń sandboxa.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319.
Wstrzyknięcie atrybutów w Set-Cookie w bibliotece cookies pozwala na obejście zabezpieczeń ciasteczek.
Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces.
Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, thereby gaining the…
Użycie hardkodowanych poświadczeń w DrEryk Gabinet umożliwia nieautoryzowany dostęp do API.
Luka w PCS umożliwia lokalnemu atakującemu odczytanie plików z wrażliwymi danymi.
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an…
Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked directory confinement checks.
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with…
Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potential email…
Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha (when no captcha…
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user_meta_save() function…
Wtyczka Aruba HiSpeed Cache dla WordPressa ma podatność na XSS, co pozwala na wstrzykiwanie skryptów.
GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker.
GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker.
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-88894 Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and… |
PozostałePubliczny PoC |
CVSS 5,3EPSS 0,26 % | ||
| CVE-2026-88884 Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0,… |
Pozostałe |
CVSS 6,9EPSS 0,31 % | ||
| CVE-2026-88878 Brak limitów czasowych w HTTP/3 w Traefik umożliwia atak DoS przez nieautoryzowanych klientów. |
Pozostałe |
CVSS 6,9EPSS 0,42 % | ||
| CVE-2026-88871 Wtyczka CustomizeUser w WWBN AVideo umożliwia atak CSRF, co pozwala na fałszowanie liczby subskrybentów. |
Pozostałe |
CVSS 5,3EPSS 0,18 % | ||
| CVE-2026-88875 AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns… |
Pozostałe |
CVSS 5,3EPSS 0,31 % | ||
| CVE-2026-88790 A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the… |
Pozostałe |
CVSS 0,9EPSS 0,17 % | ||
| CVE-2026-45763 Niespójne egzekwowanie limitu pamięci w Suricata pozwala na przekroczenie zabezpieczeń sandboxa. |
Pozostałe |
CVSS 5,9EPSS 0,62 % | ||
| CVE-2026-12682 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue… |
Pozostałe |
CVSS 5,4EPSS 0,23 % | ||
| CVE-2026-12683 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue… |
Pozostałe |
CVSS 5,4EPSS 0,23 % | ||
| CVE-2026-88038 Wstrzyknięcie atrybutów w Set-Cookie w bibliotece cookies pozwala na obejście zabezpieczeń ciasteczek. |
Pozostałe |
CVSS 4,8EPSS 0,25 % | ||
| CVE-2026-9161 Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 10092026. NOTE: The vendor was… |
Pozostałe |
CVSS 5,3EPSS 0,33 % | ||
| CVE-2026-85543 Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration… |
Pozostałe |
CVSS 4,3EPSS 0,27 % | ||
| CVE-2026-85544 Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may… |
Pozostałe |
CVSS 6,1EPSS 0,41 % | ||
| CVE-2026-17038 Użycie hardkodowanych poświadczeń w DrEryk Gabinet umożliwia nieautoryzowany dostęp do API. |
PozostałeCERT.pl |
CVSS 6,9EPSS 0,42 % | ||
| CVE-2026-84828 Luka w PCS umożliwia lokalnemu atakującemu odczytanie plików z wrażliwymi danymi. |
Pozostałe |
CVSS 6,5EPSS 0,14 % | ||
| CVE-2026-88859 A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this… |
Pozostałe |
CVSS 6,3EPSS 0,53 % | ||
| CVE-2026-78085 Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked directory confinement checks. |
Pozostałe |
CVSS 6,9EPSS 0,5 % | ||
| CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked authorization checks and… |
Pozostałe |
CVSS 6,9EPSS 0,33 % | ||
| CVE-2026-78303 Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted… |
Pozostałe |
CVSS 6,9EPSS 0,43 % | ||
| CVE-2026-78374 Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that… |
Pozostałe |
CVSS 6,9EPSS 0,54 % | ||
| CVE-2026-5399 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to… |
Pozostałe |
CVSS 6,4EPSS 0,35 % | ||
| CVE-2026-15889 Wtyczka Aruba HiSpeed Cache dla WordPressa ma podatność na XSS, co pozwala na wstrzykiwanie skryptów. |
Pozostałe |
CVSS 6,4EPSS 0,26 % | ||
| CVE-2026-88280 GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker. |
Pozostałe |
CVSS 4,9EPSS 0,44 % | ||
| CVE-2026-88281 GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF… |
Pozostałe |
CVSS 4,9EPSS 0,44 % | ||
| CVE-2026-88283 GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF… |
Pozostałe |
CVSS 4,9EPSS 0,44 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 5.11.2026, 11:02 UTC – 5.11.2026, 16:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.