KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: (1) the…
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postBodyCss’ parameter in all versions up to, and including, 2.4.4 due to insufficient input…
Przechowywanie haseł w czystym tekście w OptimiDoc Server umożliwia ujawnienie danych uwierzytelniających.
RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in…
Wykrycie w SysPasswordDxe w InsydeH2O ujawnia hashe haseł, co prowadzi do eskalacji uprawnień.
Błąd w obsłudze zmiennej UEFI PlatformLangCodes może prowadzić do przepełnienia bufora i wyczerpania zasobów.
A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code_agent.py of the component CodeAgent. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit has been…
Manipulacja argumentem img_bytes w simular-ai Agent-S prowadzi do zużycia zasobów.
A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service.…
A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shell_exec of the file crates/openfang-runtime/src/tool_runner.rs. This manipulation causes uncontrolled memory allocation. The attack is possible to…
A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler. The manipulation of the argument _display_name leads to path traversal.…
A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in…
A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulation causes uncontrolled memory allocation. The attack can be initiated remotely. The exploit has been…
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESS_VM_READ permission…
Wtyczka SEOWriting dla WordPressa ma lukę XSS, umożliwiającą atakującym wstrzykiwanie złośliwego JavaScriptu.
W UpSignOn dla Windows występuje ujawnienie danych, umożliwiające lokalnym atakującym odzyskanie hasła głównego.
UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can…
A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication.…
A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstrap Setup Endpoint. The manipulation leads to missing authentication. The attack can be initiated…
Luka w tsi-coop tsi-dpdp-cms umożliwia zdalne obejście zabezpieczeń po stronie klienta.
A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of the file packages/core/src/agent/agent.ts of the component Browser Agent Message Construction.…
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copies and rescans buffered text in _SSELineDecoder.decode() when an attacker-controlled or compromised…
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type values and custom headers from the files= three-element (filename,…
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its…
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-3852 The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all versions up to, and including,… |
Pozostałe |
CVSS 6,4EPSS 0,26 % | ||
| CVE-2026-2573 The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postBodyCss’ parameter in… |
Pozostałe |
CVSS 6,4EPSS 0,26 % | ||
| CVE-2026-15933 Przechowywanie haseł w czystym tekście w OptimiDoc Server umożliwia ujawnienie danych uwierzytelniających. |
PozostałeCERT.pl |
CVSS 6,9EPSS 0,54 % | ||
| CVE-2026-17539 RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue.… |
Pozostałe |
CVSS 5,9EPSS 0,37 % | ||
| CVE-2021-43613 Wykrycie w SysPasswordDxe w InsydeH2O ujawnia hashe haseł, co prowadzi do eskalacji uprawnień. |
Pozostałe |
CVSS 6,5EPSS 0,13 % | ||
| CVE-2021-43614 Błąd w obsłudze zmiennej UEFI PlatformLangCodes może prowadzić do przepełnienia bufora i wyczerpania zasobów. |
Pozostałe |
CVSS 6,7EPSS 0,15 % | ||
| CVE-2026-84885 A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code_agent.py of the component CodeAgent. Such manipulation leads to denial… |
Pozostałe |
CVSS 2,1EPSS 0,47 % | ||
| CVE-2026-84886 Manipulacja argumentem img_bytes w simular-ai Agent-S prowadzi do zużycia zasobów. |
Pozostałe |
CVSS 5,5EPSS 0,64 % | ||
| CVE-2026-84887 A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action… |
Pozostałe |
CVSS 2,1EPSS 0,57 % | ||
| CVE-2026-84888 A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shell_exec of the file crates/openfang-runtime/src/tool_runner.rs. This… |
Pozostałe |
CVSS 2,1EPSS 0,47 % | ||
| CVE-2026-84852 A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler.… |
Pozostałe |
CVSS 4,4EPSS 0,21 % | ||
| CVE-2026-84856 A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of… |
Pozostałe |
CVSS 5,5EPSS 0,7 % | ||
| CVE-2026-84857 A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulation causes uncontrolled memory… |
Pozostałe |
CVSS 5,5EPSS 0,64 % | ||
| CVE-2026-75137 UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the… |
Pozostałe |
CVSS 6,9EPSS 0,1 % | ||
| CVE-2026-75134 Wtyczka SEOWriting dla WordPressa ma lukę XSS, umożliwiającą atakującym wstrzykiwanie złośliwego JavaScriptu. |
Pozostałe |
CVSS 5,1EPSS 0,32 % | ||
| CVE-2026-75135 W UpSignOn dla Windows występuje ujawnienie danych, umożliwiające lokalnym atakującym odzyskanie hasła głównego. |
Pozostałe |
CVSS 6,9EPSS 0,1 % | ||
| CVE-2026-75136 UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows… |
Pozostałe |
CVSS 6,9EPSS 0,16 % | ||
| CVE-2026-84839 A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance… |
Pozostałe |
CVSS 5,5EPSS 0,77 % | ||
| CVE-2026-84840 A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstrap Setup Endpoint. The… |
Pozostałe |
CVSS 6,5EPSS 0,8 % | ||
| CVE-2026-84841 Luka w tsi-coop tsi-dpdp-cms umożliwia zdalne obejście zabezpieczeń po stronie klienta. |
Pozostałe |
CVSS 5,5EPSS 0,54 % | ||
| CVE-2026-84833 A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of the file… |
Pozostałe |
CVSS 2,1EPSS 0,51 % | ||
| CVE-2026-84378 HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copies and rescans buffered text… |
Pozostałe |
CVSS 5,9EPSS 0,32 % | ||
| CVE-2026-84379 HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type… |
Pozostałe |
CVSS 5,3EPSS 0,32 % | ||
| CVE-2026-84380 HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that… |
Pozostałe |
CVSS 5,6EPSS 0,22 % | ||
| CVE-2026-84377 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound… |
Pozostałe |
CVSS 6,5EPSS 0,54 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 10.11.2026, 15:32 UTC – 10.11.2026, 17:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.