KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function save_pipeline/load_pipeline of the file pipeline_tools.py. Performing a manipulation results in path traversal. The attack can be initiated remotely.…
A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function s_fetch_page/s_fetch_pattern of the file src/scrapling_fetch_mcp/_fetcher.py. Executing a manipulation can lead to server-side request…
A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration.
A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetch_instructions of the file malicious_mcp_server.py of the component MCP Integration Trust Model. The manipulation leads to code injection. The…
A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAuth Callback. The manipulation results in cleartext transmission of sensitive…
A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the…
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a…
cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject…
The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator into initiating…
Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the risk of credential compromise through visual or remote observation. This undermines the confidentiality of device access.
Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control.
Błąd w Wazuh umożliwia atakującemu zdalne wywołanie awarii agenta, co prowadzi do odmowy usługi.
Błąd w Wazuh pozwala na odczytanie tajnego klucza klastra przez użytkownika z niskimi uprawnieniami.
A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.
In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service. This is only present for EFR32MG24 and EFR32MG26 devices running concurrent multiprotocol Zigbee and Thread.
A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same…
Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission (routine Seller role) to execute arbitrary JavaScript in the application…
A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/helpers.ts of the component CodeIndexManager. Performing a manipulation results in code injection.…
A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a manipulation can lead to code injection. The attack can be executed remotely.…
Luka w AWS diagram-as-code umożliwia zapis dowolnych plików na systemie lokalnym.
Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignore_xss_filter": 1 in frappe/desk/doctype/workspace_link/workspace_link.json, and…
A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs,…
A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An…
A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-81847 A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function save_pipeline/load_pipeline of the file pipeline_tools.py. Performing a… |
Pozostałe |
CVSS 2,0EPSS 0,35 % | ||
| CVE-2026-81848 A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function s_fetch_page/s_fetch_pattern of the file… |
Pozostałe |
CVSS 5,1EPSS 0,35 % | ||
| CVE-2026-81851 A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a… |
Pozostałe |
CVSS 6,9EPSS 0,41 % | ||
| CVE-2026-81835 A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetch_instructions of the file malicious_mcp_server.py of the component MCP… |
Pozostałe |
CVSS 2,0EPSS 0,3 % | ||
| CVE-2026-81836 A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAuth Callback.… |
Pozostałe |
CVSS 2,9EPSS 0,28 % | ||
| CVE-2026-81837 A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This… |
Pozostałe |
CVSS 2,1EPSS 0,49 % | ||
| CVE-2026-80179 A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the… |
Pozostałe |
CVSS 5,9EPSS 0,3 % | ||
| CVE-2026-77341 cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without… |
Pozostałe |
CVSS 5,3EPSS 0,46 % | ||
| CVE-2026-75548 The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted… |
Pozostałe |
CVSS 5,3EPSS 0,29 % | ||
| CVE-2026-73839 Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the risk of credential compromise through visual or remote observation.… |
Pozostałe |
CVSS 5,1EPSS 0,2 % | ||
| CVE-2026-71396 Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control. |
Pozostałe |
CVSS 5,3EPSS 0,24 % | ||
| CVE-2026-54084 Błąd w Wazuh umożliwia atakującemu zdalne wywołanie awarii agenta, co prowadzi do odmowy usługi. |
PozostałePubliczny PoC |
CVSS 5,3EPSS 0,2 % | ||
| CVE-2026-61783 Błąd w Wazuh pozwala na odczytanie tajnego klucza klastra przez użytkownika z niskimi uprawnieniami. |
PozostałePubliczny PoC |
CVSS 6,5EPSS 0,41 % | ||
| CVE-2026-38345 A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a… |
Pozostałe |
CVSS 6,5EPSS 0,36 % | ||
| CVE-2026-38343 An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file. |
Pozostałe |
CVSS 6,5EPSS 0,36 % | ||
| CVE-2026-17610 In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service. This is only present for EFR32MG24 and EFR32MG26 devices running… |
Pozostałe |
CVSS 6,0EPSS 0,25 % | ||
| CVE-2026-81893 A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after… |
Pozostałe |
CVSS 4,7EPSS 0,15 % | ||
| CVE-2026-81931 Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission… |
Pozostałe |
CVSS 4,8EPSS 0,49 % | ||
| CVE-2026-81833 A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/helpers.ts of the component… |
Pozostałe |
CVSS 2,0EPSS 0,3 % | ||
| CVE-2026-81834 A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a… |
Pozostałe |
CVSS 2,1EPSS 0,4 % | ||
| CVE-2026-81838 Luka w AWS diagram-as-code umożliwia zapis dowolnych plików na systemie lokalnym. |
Pozostałe |
CVSS 6,8EPSS 0,2 % | ||
| CVE-2026-81731 Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with… |
Pozostałe |
CVSS 5,1EPSS 0,3 % | ||
| CVE-2026-81527 A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When… |
Pozostałe |
CVSS 6,9EPSS 0,31 % | ||
| CVE-2026-81528 A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the… |
Pozostałe |
CVSS 5,3EPSS 0,28 % | ||
| CVE-2026-81530 A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be reproduced… |
Pozostałe |
CVSS 6,8EPSS 0,1 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 23:02 UTC – 13.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.