KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319.
Wstrzyknięcie atrybutów w Set-Cookie w bibliotece cookies pozwala na obejście zabezpieczeń ciasteczek.
Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces.
Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, thereby gaining the…
Użycie hardkodowanych poświadczeń w DrEryk Gabinet umożliwia nieautoryzowany dostęp do API.
Luka w PCS umożliwia lokalnemu atakującemu odczytanie plików z wrażliwymi danymi.
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an…
Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked directory confinement checks.
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with…
Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potential email…
Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha (when no captcha…
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user_meta_save() function…
Wtyczka Aruba HiSpeed Cache dla WordPressa ma podatność na XSS, co pozwala na wstrzykiwanie skryptów.
GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker.
GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker.
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service.
GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker.
Błąd w crun pozwala na przekierowanie /dev/console na ścieżkę kontrolowaną przez atakującego.
Błąd w crun pozwala na podmianę pliku stdio kontenera, co może prowadzić do zmiany jego właściciela.
GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service.
GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVR.
GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-12683 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue… |
Pozostałe |
CVSS 5,4EPSS 0,23 % | ||
| CVE-2026-88038 Wstrzyknięcie atrybutów w Set-Cookie w bibliotece cookies pozwala na obejście zabezpieczeń ciasteczek. |
Pozostałe |
CVSS 4,8EPSS 0,25 % | ||
| CVE-2026-9161 Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 10092026. NOTE: The vendor was… |
Pozostałe |
CVSS 5,3EPSS 0,33 % | ||
| CVE-2026-85543 Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration… |
Pozostałe |
CVSS 4,3EPSS 0,27 % | ||
| CVE-2026-85544 Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may… |
Pozostałe |
CVSS 6,1EPSS 0,41 % | ||
| CVE-2026-17038 Użycie hardkodowanych poświadczeń w DrEryk Gabinet umożliwia nieautoryzowany dostęp do API. |
PozostałeCERT.pl |
CVSS 6,9EPSS 0,42 % | ||
| CVE-2026-84828 Luka w PCS umożliwia lokalnemu atakującemu odczytanie plików z wrażliwymi danymi. |
Pozostałe |
CVSS 6,5EPSS 0,14 % | ||
| CVE-2026-88859 A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this… |
Pozostałe |
CVSS 6,3EPSS 0,53 % | ||
| CVE-2026-78085 Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked directory confinement checks. |
Pozostałe |
CVSS 6,9EPSS 0,5 % | ||
| CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked authorization checks and… |
Pozostałe |
CVSS 6,9EPSS 0,33 % | ||
| CVE-2026-78303 Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted… |
Pozostałe |
CVSS 6,9EPSS 0,43 % | ||
| CVE-2026-78374 Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that… |
Pozostałe |
CVSS 6,9EPSS 0,54 % | ||
| CVE-2026-5399 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to… |
Pozostałe |
CVSS 6,4EPSS 0,35 % | ||
| CVE-2026-15889 Wtyczka Aruba HiSpeed Cache dla WordPressa ma podatność na XSS, co pozwala na wstrzykiwanie skryptów. |
Pozostałe |
CVSS 6,4EPSS 0,26 % | ||
| CVE-2026-88280 GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker. |
Pozostałe |
CVSS 4,9EPSS 0,44 % | ||
| CVE-2026-88281 GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF… |
Pozostałe |
CVSS 4,9EPSS 0,44 % | ||
| CVE-2026-88283 GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF… |
Pozostałe |
CVSS 4,9EPSS 0,44 % | ||
| CVE-2026-88284 GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF… |
Pozostałe |
CVSS 4,9EPSS 0,44 % | ||
| CVE-2026-88288 GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the… |
Pozostałe |
CVSS 6,5EPSS 0,55 % | ||
| CVE-2026-88279 GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker. |
Pozostałe |
CVSS 4,9EPSS 0,44 % | ||
| CVE-2026-88264 Błąd w crun pozwala na przekierowanie /dev/console na ścieżkę kontrolowaną przez atakującego. |
Pozostałe |
CVSS 5,6EPSS 0,12 % | ||
| CVE-2026-88265 Błąd w crun pozwala na podmianę pliku stdio kontenera, co może prowadzić do zmiany jego właściciela. |
Pozostałe |
CVSS 5,6EPSS 0,12 % | ||
| CVE-2026-88268 GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service. |
Pozostałe |
CVSS 6,5EPSS 0,41 % | ||
| CVE-2026-88269 GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVR. |
Pozostałe |
CVSS 6,5EPSS 0,34 % | ||
| CVE-2026-88270 GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated. |
Pozostałe |
CVSS 6,5EPSS 0,37 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 5.11.2026, 15:02 UTC – 5.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.