KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its…
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to…
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG…
Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended…
A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an…
An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed an account holding read or browse permission on a group repository to retrieve metadata for member…
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged sensitive OAuth and OpenID Connect values in business event logs. Logged…
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion…
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter (-r parameter), typically used…
DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is possible via the COAR Notify…
Obejście autoryzacji w Astro pozwala atakującemu na dostęp do chronionych tras.
Podatność w Open edX umożliwia atak SSRF z wyciekiem danych przez nieograniczone przekierowania.
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed…
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The…
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities…
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities…
Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able…
Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators.
Luka w Jenkins Job Configuration History Plugin pozwala na modyfikację ustawień przechowywania historii.
In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can…
Wstrzyknięcie pól w odpowiedziach API w Jenkins umożliwia manipulację danymi.
Brak sprawdzenia uprawnień w Jenkins umożliwia nieautoryzowanym dostęp do parametrów budowy.
Brak weryfikacji uprawnień w Jenkins pozwala atakującym na anulowanie budów innych użytkowników.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-84380 HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that… |
Pozostałe |
CVSS 5,6EPSS 0,22 % | ||
| CVE-2026-84377 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound… |
Pozostałe |
CVSS 6,5EPSS 0,54 % | ||
| CVE-2026-82522 libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size… |
Pozostałe |
CVSS 5,3EPSS 0,41 % | ||
| CVE-2026-77123 Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext… |
Pozostałe |
CVSS 6,5EPSS 0,46 % | ||
| CVE-2026-77121 A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or… |
Pozostałe |
CVSS 6,5EPSS 0,25 % | ||
| CVE-2026-77122 An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed an account holding read or… |
Pozostałe |
CVSS 4,3EPSS 0,28 % | ||
| CVE-2026-55221 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged… |
Pozostałe |
CVSS 6,5EPSS 0,48 % | ||
| CVE-2026-49830 DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE… |
Pozostałe |
CVSS 4,4EPSS 0,49 % | ||
| CVE-2026-49831 DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an… |
Pozostałe |
CVSS 5,5EPSS 0,53 % | ||
| CVE-2026-49833 DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before… |
Pozostałe |
CVSS 5,5EPSS 0,37 % | ||
| CVE-2026-84376 Obejście autoryzacji w Astro pozwala atakującemu na dostęp do chronionych tras. |
Pozostałe |
CVSS 6,3EPSS 0,71 % | ||
| CVE-2026-55421 Podatność w Open edX umożliwia atak SSRF z wyciekiem danych przez nieograniczone przekierowania. |
Pozostałe |
CVSS 6,8EPSS 0,46 % | ||
| CVE-2026-52832 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP… |
Pozostałe |
CVSS 4,9EPSS 0,56 % | ||
| CVE-2026-53636 Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's… |
Pozostałe |
CVSS 4,7EPSS 0,28 % | ||
| CVE-2026-20355 Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to… |
Pozostałe |
CVSS 5,9EPSS 0,2 % | ||
| CVE-2026-20354 Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to… |
Pozostałe |
CVSS 5,9EPSS 0,2 % | ||
| CVE-2026-84674 Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. |
Pozostałe |
CVSS 5,4EPSS 0,23 % | ||
| CVE-2026-84676 Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with… |
Pozostałe |
CVSS 4,3EPSS 0,19 % | ||
| CVE-2026-84677 Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pages, resulting in a stored… |
Pozostałe |
CVSS 5,4EPSS 0,23 % | ||
| CVE-2026-84664 Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified… |
Pozostałe |
CVSS 5,4EPSS 0,14 % | ||
| CVE-2026-84666 Luka w Jenkins Job Configuration History Plugin pozwala na modyfikację ustawień przechowywania historii. |
Pozostałe |
CVSS 5,4EPSS 0,14 % | ||
| CVE-2026-84654 In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static… |
Pozostałe |
CVSS 5,4EPSS 0,25 % | ||
| CVE-2026-84655 Wstrzyknięcie pól w odpowiedziach API w Jenkins umożliwia manipulację danymi. |
Pozostałe |
CVSS 4,3EPSS 0,48 % | ||
| CVE-2026-84656 Brak sprawdzenia uprawnień w Jenkins umożliwia nieautoryzowanym dostęp do parametrów budowy. |
Pozostałe |
CVSS 4,3EPSS 0,46 % | ||
| CVE-2026-84657 Brak weryfikacji uprawnień w Jenkins pozwala atakującym na anulowanie budów innych użytkowników. |
Pozostałe |
CVSS 4,2EPSS 0,39 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 11.11.2026, 11:32 UTC – 11.11.2026, 13:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.