KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a…
Błąd walidacji w Chainlit umożliwia atakującym modyfikację lub usunięcie opinii innych użytkowników.
StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling…
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary…
StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing executeWithoutPassword(). Attackers can access six unauthenticated endpoints on the frontend HTTP…
Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage…
Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert…
Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files…
Błąd w MongoSQL Transition Readiness Tool umożliwia ujawnienie danych przez złośliwe formuły w CSV.
Brak kodowania w narzędziu MongoSQL umożliwia atak XSS, co może ujawnić dane użytkowników.
In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify…
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The web_radiusSrv*_post family of handlers copies the radKey, radKey_0, radDftParamKey,…
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The web_login_first_post handler copies the usrPass POST parameter into a fixed-size stack buffer without length…
Wstrzyknięcie skryptu w MongoSQL Transition Readiness Tool pozwala na wykonanie kodu w raporcie.
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_alive_rmtip_post handler dereferences the rmtIP parameter without verifying its presence. A remote…
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy attacker-controlled POST parameters into fixed-size stack buffers without…
Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
Nieprawidłowe neutralizowanie delimitatorów w Microsoft Edge umożliwia zdalne wykonanie kodu.
Zewnętrzna kontrola nazwy pliku w Microsoft Edge umożliwia atakującemu oszustwo w sieci.
Wykorzystanie po zwolnieniu pamięci w Microsoft Edge umożliwia zdalne wykonanie kodu.
Błędna autoryzacja w Microsoft Edge umożliwia nieautoryzowanemu atakującemu ujawnienie informacji.
Wyścig warunków w Copilot Chat umożliwia autoryzowanemu atakującemu ujawnienie informacji w sieci.
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirect_uri query parameter and frontend/src/routes/authorize/+page.svelte uses the raw…
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-82343 A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect… |
Pozostałe |
CVSS 6,1EPSS 0,18 % | ||
| CVE-2026-82290 Błąd walidacji w Chainlit umożliwia atakującym modyfikację lub usunięcie opinii innych użytkowników. |
Pozostałe |
CVSS 6,0EPSS 0,34 % | ||
| CVE-2026-82306 StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low… |
Pozostałe |
CVSS 6,5EPSS 0,55 % | ||
| CVE-2026-82274 Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL.… |
Pozostałe |
CVSS 5,3EPSS 0,39 % | ||
| CVE-2026-82276 StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing executeWithoutPassword().… |
Pozostałe |
CVSS 5,3EPSS 0,53 % | ||
| CVE-2026-82265 Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers… |
Pozostałe |
CVSS 6,9EPSS 0,45 % | ||
| CVE-2026-82267 Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated… |
Pozostałe |
CVSS 5,3EPSS 0,3 % | ||
| CVE-2026-82264 Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious… |
Pozostałe |
CVSS 6,1EPSS 0,71 % | ||
| CVE-2026-76797 Błąd w MongoSQL Transition Readiness Tool umożliwia ujawnienie danych przez złośliwe formuły w CSV. |
Pozostałe |
CVSS 5,8EPSS 0,35 % | ||
| CVE-2026-76798 Brak kodowania w narzędziu MongoSQL umożliwia atak XSS, co może ujawnić dane użytkowników. |
Pozostałe |
CVSS 6,9EPSS 0,29 % | ||
| CVE-2026-77184 In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without… |
Pozostałe |
CVSS 5,7EPSS 0,31 % | ||
| CVE-2026-77217 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The… |
Pozostałe |
CVSS 6,9EPSS 0,6 % | ||
| CVE-2026-77218 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The web_login_first_post handler copies the… |
Pozostałe |
CVSS 6,9EPSS 0,57 % | ||
| CVE-2026-76794 Wstrzyknięcie skryptu w MongoSQL Transition Readiness Tool pozwala na wykonanie kodu w raporcie. |
Pozostałe |
CVSS 4,8EPSS 0,23 % | ||
| CVE-2026-75125 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_alive_rmtip_post handler… |
Pozostałe |
CVSS 6,9EPSS 0,56 % | ||
| CVE-2026-75126 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy… |
Pozostałe |
CVSS 6,9EPSS 0,6 % | ||
| CVE-2026-70331 Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network. |
Pozostałe |
CVSS 5,4EPSS 0,41 % | ||
| CVE-2026-70309 Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. |
Pozostałe |
CVSS 5,4EPSS 0,21 % | ||
| CVE-2026-66323 Nieprawidłowe neutralizowanie delimitatorów w Microsoft Edge umożliwia zdalne wykonanie kodu. |
Pozostałe |
CVSS 5,4EPSS 0,41 % | ||
| CVE-2026-66324 Zewnętrzna kontrola nazwy pliku w Microsoft Edge umożliwia atakującemu oszustwo w sieci. |
Pozostałe |
CVSS 6,5EPSS 0,92 % | ||
| CVE-2026-66798 Wykorzystanie po zwolnieniu pamięci w Microsoft Edge umożliwia zdalne wykonanie kodu. |
Pozostałe |
CVSS 4,3EPSS 0,79 % | ||
| CVE-2026-62904 Błędna autoryzacja w Microsoft Edge umożliwia nieautoryzowanemu atakującemu ujawnienie informacji. |
Pozostałe |
CVSS 5,4EPSS 0,39 % | ||
| CVE-2026-58616 Wyścig warunków w Copilot Chat umożliwia autoryzowanemu atakującemu ujawnienie informacji w sieci. |
Pozostałe |
CVSS 3,0EPSS 0,3 % | ||
| CVE-2026-55834 Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirect_uri query… |
Pozostałe |
CVSS 4,3EPSS 0,37 % | ||
| CVE-2026-55566 Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/… |
Pozostałe |
CVSS 4,3EPSS 0,38 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 15:02 UTC – 12.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.