KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_searchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely.…
Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14.
Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51.
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag…
Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the…
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link> header tags. It escaped the attribute names it wrote, but ran the attribute values through a…
Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The locale, style and…
ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was…
AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model…
Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill…
DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or…
DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another (ShareTicketManage.validateTicket / POST…
A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results…
A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the…
A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The…
A flaw has been found in IObit Uninstaller 15.5.0.11. This affects the function IRP_MJ_DEVICE_CONTROL in the library IUForceDelete.sys of the component IOCTL Handler. Executing a manipulation can lead to improper privilege management. The attack requires…
A vulnerability has been found in IObit Unlocker 1.3.0.12. This vulnerability affects the function ZwTerminateProcess in the library IObitUnlocker.sys of the component IRP_MJ_DEVICE_CONTROL Handler. The manipulation leads to improper privilege management. An…
A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit…
Obejście autoryzacji w ToolJet umożliwia ujawnienie schematów baz danych i eksport aplikacji.
Obejście uwierzytelnienia w ToolJet umożliwia manipulację tabelami w innych przestrzeniach roboczych.
Wielokrotne wstrzyknięcie skryptów w pdfme pozwala na wykonanie złośliwego kodu przez atakujących.
Wtyczka Select w @pdfme/schemas przed 5.5.9 ma lukę XSS, umożliwiającą wykonanie kodu w przeglądarkach.
Wtyczka SVG w @pdfme/schemas umożliwia atak XSS przez niezabezpieczone wstawianie SVG.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-82696 A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_searchfrm.php. This manipulation of the… |
Pozostałe |
CVSS 2,1EPSS 0,33 % | ||
| CVE-2026-74010 Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through… |
Pozostałe |
CVSS 5,3EPSS 0,31 % | ||
| CVE-2026-51666 Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state via… |
Pozostałe |
CVSS 4,3EPSS 0,29 % | ||
| CVE-2026-51667 Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via sending a… |
Pozostałe |
CVSS 4,3EPSS 0,29 % | ||
| CVE-2026-82797 Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51. |
Pozostałe |
CVSS 5,5EPSS 0,15 % | ||
| CVE-2026-76982 Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that… |
Pozostałe |
CVSS 5,4EPSS 0,51 % | ||
| CVE-2026-76983 Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is… |
Pozostałe |
CVSS 5,4EPSS 0,51 % | ||
| CVE-2026-76984 Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link> header tags. It escaped the… |
Pozostałe |
CVSS 5,4EPSS 0,51 % | ||
| CVE-2026-70449 Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the… |
Pozostałe |
CVSS 5,3EPSS 0,91 % | ||
| CVE-2026-71378 ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another… |
Pozostałe |
CVSS 4,6EPSS 0,25 % | ||
| CVE-2026-75802 AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without… |
Pozostałe |
CVSS 5,4EPSS 0,51 % | ||
| CVE-2026-82881 Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and… |
Pozostałe |
CVSS 5,1EPSS 0,31 % | ||
| CVE-2026-82878 DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to… |
Pozostałe |
CVSS 5,3EPSS 0,34 % | ||
| CVE-2026-82879 DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be… |
Pozostałe |
CVSS 5,3EPSS 0,36 % | ||
| CVE-2026-82679 A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.p… |
Pozostałe |
CVSS 2,1EPSS 0,37 % | ||
| CVE-2026-82678 A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php… |
Pozostałe |
CVSS 4,7EPSS 2,18 % | ||
| CVE-2026-82669 A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML… |
Pozostałe |
CVSS 5,5EPSS 0,74 % | ||
| CVE-2026-82670 A flaw has been found in IObit Uninstaller 15.5.0.11. This affects the function IRP_MJ_DEVICE_CONTROL in the library IUForceDelete.sys of the component IOCTL Handler. Executing a… |
Pozostałe |
CVSS 4,8EPSS 0,15 % | ||
| CVE-2026-82671 A vulnerability has been found in IObit Unlocker 1.3.0.12. This vulnerability affects the function ZwTerminateProcess in the library IObitUnlocker.sys of the component… |
Pozostałe |
CVSS 4,6EPSS 0,16 % | ||
| CVE-2026-82677 A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation… |
Pozostałe |
CVSS 1,9EPSS 0,29 % | ||
| CVE-2026-82873 Obejście autoryzacji w ToolJet umożliwia ujawnienie schematów baz danych i eksport aplikacji. |
Pozostałe |
CVSS 5,3EPSS 0,31 % | ||
| CVE-2026-82875 Obejście uwierzytelnienia w ToolJet umożliwia manipulację tabelami w innych przestrzeniach roboczych. |
Pozostałe |
CVSS 5,1EPSS 0,22 % | ||
| CVE-2026-82865 Wielokrotne wstrzyknięcie skryptów w pdfme pozwala na wykonanie złośliwego kodu przez atakujących. |
Pozostałe |
CVSS 2,1EPSS 0,2 % | ||
| CVE-2026-82867 Wtyczka Select w @pdfme/schemas przed 5.5.9 ma lukę XSS, umożliwiającą wykonanie kodu w przeglądarkach. |
Pozostałe |
CVSS 5,3EPSS 0,31 % | ||
| CVE-2026-82868 Wtyczka SVG w @pdfme/schemas umożliwia atak XSS przez niezabezpieczone wstawianie SVG. |
Pozostałe |
CVSS 5,3EPSS 0,26 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 07:02 UTC – 12.11.2026, 12:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.