KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files…
Błąd w MongoSQL Transition Readiness Tool umożliwia ujawnienie danych przez złośliwe formuły w CSV.
Brak kodowania w narzędziu MongoSQL umożliwia atak XSS, co może ujawnić dane użytkowników.
In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify…
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The web_radiusSrv*_post family of handlers copies the radKey, radKey_0, radDftParamKey,…
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The web_login_first_post handler copies the usrPass POST parameter into a fixed-size stack buffer without length…
Wstrzyknięcie skryptu w MongoSQL Transition Readiness Tool pozwala na wykonanie kodu w raporcie.
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_alive_rmtip_post handler dereferences the rmtIP parameter without verifying its presence. A remote…
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy attacker-controlled POST parameters into fixed-size stack buffers without…
Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
Nieprawidłowe neutralizowanie delimitatorów w Microsoft Edge umożliwia zdalne wykonanie kodu.
Zewnętrzna kontrola nazwy pliku w Microsoft Edge umożliwia atakującemu oszustwo w sieci.
Wykorzystanie po zwolnieniu pamięci w Microsoft Edge umożliwia zdalne wykonanie kodu.
Błędna autoryzacja w Microsoft Edge umożliwia nieautoryzowanemu atakującemu ujawnienie informacji.
Wyścig warunków w Copilot Chat umożliwia autoryzowanemu atakującemu ujawnienie informacji w sieci.
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirect_uri query parameter and frontend/src/routes/authorize/+page.svelte uses the raw…
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and…
aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction…
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without…
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated…
Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by…
Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows…
Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the request body project_view_id value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The…
Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-82264 Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious… |
Pozostałe |
CVSS 6,1EPSS 0,71 % | ||
| CVE-2026-76797 Błąd w MongoSQL Transition Readiness Tool umożliwia ujawnienie danych przez złośliwe formuły w CSV. |
Pozostałe |
CVSS 5,8EPSS 0,35 % | ||
| CVE-2026-76798 Brak kodowania w narzędziu MongoSQL umożliwia atak XSS, co może ujawnić dane użytkowników. |
Pozostałe |
CVSS 6,9EPSS 0,29 % | ||
| CVE-2026-77184 In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without… |
Pozostałe |
CVSS 5,7EPSS 0,31 % | ||
| CVE-2026-77217 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The… |
Pozostałe |
CVSS 6,9EPSS 0,6 % | ||
| CVE-2026-77218 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The web_login_first_post handler copies the… |
Pozostałe |
CVSS 6,9EPSS 0,57 % | ||
| CVE-2026-76794 Wstrzyknięcie skryptu w MongoSQL Transition Readiness Tool pozwala na wykonanie kodu w raporcie. |
Pozostałe |
CVSS 4,8EPSS 0,23 % | ||
| CVE-2026-75125 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_alive_rmtip_post handler… |
Pozostałe |
CVSS 6,9EPSS 0,56 % | ||
| CVE-2026-75126 PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy… |
Pozostałe |
CVSS 6,9EPSS 0,6 % | ||
| CVE-2026-70331 Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network. |
Pozostałe |
CVSS 5,4EPSS 0,41 % | ||
| CVE-2026-70309 Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. |
Pozostałe |
CVSS 5,4EPSS 0,21 % | ||
| CVE-2026-66323 Nieprawidłowe neutralizowanie delimitatorów w Microsoft Edge umożliwia zdalne wykonanie kodu. |
Pozostałe |
CVSS 5,4EPSS 0,41 % | ||
| CVE-2026-66324 Zewnętrzna kontrola nazwy pliku w Microsoft Edge umożliwia atakującemu oszustwo w sieci. |
Pozostałe |
CVSS 6,5EPSS 0,92 % | ||
| CVE-2026-66798 Wykorzystanie po zwolnieniu pamięci w Microsoft Edge umożliwia zdalne wykonanie kodu. |
Pozostałe |
CVSS 4,3EPSS 0,79 % | ||
| CVE-2026-62904 Błędna autoryzacja w Microsoft Edge umożliwia nieautoryzowanemu atakującemu ujawnienie informacji. |
Pozostałe |
CVSS 5,4EPSS 0,39 % | ||
| CVE-2026-58616 Wyścig warunków w Copilot Chat umożliwia autoryzowanemu atakującemu ujawnienie informacji w sieci. |
Pozostałe |
CVSS 3,0EPSS 0,3 % | ||
| CVE-2026-55834 Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirect_uri query… |
Pozostałe |
CVSS 4,3EPSS 0,37 % | ||
| CVE-2026-55566 Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/… |
Pozostałe |
CVSS 4,3EPSS 0,38 % | ||
| CVE-2026-55569 aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with… |
Pozostałe |
CVSS 6,6EPSS 0,18 % | ||
| CVE-2026-55545 Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints.… |
Pozostałe |
CVSS 6,5EPSS 0,45 % | ||
| CVE-2026-55547 Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in… |
Pozostałe |
CVSS 4,3EPSS 0,34 % | ||
| CVE-2026-55549 Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into… |
Pozostałe |
CVSS 6,5EPSS 1,31 % | ||
| CVE-2026-55425 Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/re… |
Pozostałe |
CVSS 5,0EPSS 0,41 % | ||
| CVE-2026-55067 Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the request body project_view_id value… |
Pozostałe |
CVSS 5,0EPSS 0,34 % | ||
| CVE-2026-55064 Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent… |
Pozostałe |
CVSS 4,3EPSS 0,37 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 19:02 UTC – 13.11.2026, 00:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.