KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy…
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with…
Błąd w OpenSSL przed 1.4.9 umożliwia atakującym wywołanie awarii systemu przez złośliwe pliki tożsamości.
NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU…
openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is…
openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without…
AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF…
Błąd w openssl_encrypt umożliwia usunięcie slotów odzyskiwania z plików bez ponownego szyfrowania.
openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM…
Przechwycenie hasła steganograficznego w openssl_encrypt umożliwia lokalnym użytkownikom dostęp do wrażliwych danych.
The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which…
darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknet_network.cpp as xcalloc(net.n, sizeof(Darknet::Layer)), sized to exactly the number of…
The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in…
The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_server_dash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a…
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was…
APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the…
The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSION_DENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but…
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.
In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause…
In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and…
An integer underflow was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c does not verify that the IP total length field (ip_len) is at least as large as the IP header length (ihl) before subtracting the…
An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option…
Nieprawidłowa kontrola dostępu w Johnson Controls T2000 umożliwia dostęp do nieautoryzowanej funkcjonalności.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-81725 NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI… |
PozostałePubliczny PoC |
CVSS 6,3EPSS 0,37 % | ||
| CVE-2026-81727 NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files… |
PozostałePubliczny PoC |
CVSS 6,9EPSS 0,19 % | ||
| CVE-2026-81720 Błąd w OpenSSL przed 1.4.9 umożliwia atakującym wywołanie awarii systemu przez złośliwe pliki tożsamości. |
Pozostałe |
CVSS 6,9EPSS 0,19 % | ||
| CVE-2026-81723 NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read.… |
Pozostałe |
CVSS 6,3EPSS 0,28 % | ||
| CVE-2026-81706 openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible… |
Pozostałe |
CVSS 6,8EPSS 0,18 % | ||
| CVE-2026-81686 openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value… |
Pozostałe |
CVSS 5,5EPSS 0,14 % | ||
| CVE-2026-81678 AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6… |
Pozostałe |
CVSS 6,9EPSS 0,45 % | ||
| CVE-2026-81680 Błąd w openssl_encrypt umożliwia usunięcie slotów odzyskiwania z plików bez ponownego szyfrowania. |
Pozostałe |
CVSS 5,3EPSS 0,2 % | ||
| CVE-2026-81683 openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop… |
Pozostałe |
CVSS 5,5EPSS 0,07 % | ||
| CVE-2026-81684 Przechwycenie hasła steganograficznego w openssl_encrypt umożliwia lokalnym użytkownikom dostęp do wrażliwych danych. |
Pozostałe |
CVSS 6,9EPSS 0,17 % | ||
| CVE-2026-81664 The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.DecorateWithBasicAuth.… |
Pozostałe |
CVSS 6,9EPSS 0,37 % | ||
| CVE-2026-81334 darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknet_network.cpp as… |
Pozostałe |
CVSS 6,9EPSS 0,17 % | ||
| CVE-2026-81101 The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into… |
Pozostałe |
CVSS 6,9EPSS 0,45 % | ||
| CVE-2026-81102 The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_server_dash.py constructed the server for its network mode with the… |
Pozostałe |
CVSS 2,3EPSS 0,18 % | ||
| CVE-2026-80213 An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than… |
Pozostałe |
CVSS 4,0EPSS 0,35 % | ||
| CVE-2026-80207 APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any… |
Pozostałe |
CVSS 6,9EPSS 0,35 % | ||
| CVE-2026-80209 The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSION_DENIED when… |
Pozostałe |
CVSS 5,3EPSS 0,39 % | ||
| CVE-2026-79720 Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to… |
PozostałePubliczny PoC |
CVSS 5,0EPSS 0,26 % | ||
| CVE-2026-79718 Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to… |
PozostałePubliczny PoC |
CVSS 5,0EPSS 0,26 % | ||
| CVE-2026-79719 Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to… |
PozostałePubliczny PoC |
CVSS 5,0EPSS 0,26 % | ||
| CVE-2026-79653 In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the… |
Pozostałe |
CVSS 6,0EPSS 0,47 % | ||
| CVE-2026-75573 In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding… |
Pozostałe |
CVSS 5,5EPSS 0,1 % | ||
| CVE-2026-71401 An integer underflow was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c does not verify that the IP total length field (ip_len) is at… |
Pozostałe |
CVSS 5,3EPSS 0,26 % | ||
| CVE-2026-71402 An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as the payload length instead of… |
Pozostałe |
CVSS 5,3EPSS 0,25 % | ||
| CVE-2026-64896 Nieprawidłowa kontrola dostępu w Johnson Controls T2000 umożliwia dostęp do nieautoryzowanej funkcjonalności. |
Pozostałe |
CVSS 5,2EPSS 0,19 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 03:02 UTC – 13.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.