KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully…
WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force…
A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request.
A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.
A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.
A server-side request forgery (SSRF) vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.
A blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.
A stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any…
WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes…
Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memory on the device within minutes.
Wyciek klucza klastra w Wazuh umożliwia zdalne wykonanie kodu przez nieuprzywilejowane konto.
A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function import_session/export_session of the file mcp_sequential_thinking/server.py of the component Import Session/Export Session. Such manipulation of the…
A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function save_pipeline/load_pipeline of the file pipeline_tools.py. Performing a manipulation results in path traversal. The attack can be initiated remotely.…
A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function s_fetch_page/s_fetch_pattern of the file src/scrapling_fetch_mcp/_fetcher.py. Executing a manipulation can lead to server-side request…
A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration.
A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetch_instructions of the file malicious_mcp_server.py of the component MCP Integration Trust Model. The manipulation leads to code injection. The…
A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAuth Callback. The manipulation results in cleartext transmission of sensitive…
A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the…
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a…
cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject…
The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator into initiating…
Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the risk of credential compromise through visual or remote observation. This undermines the confidentiality of device access.
Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control.
Błąd w Wazuh umożliwia atakującemu zdalne wywołanie awarii agenta, co prowadzi do odmowy usługi.
Błąd w Wazuh pozwala na odczytanie tajnego klucza klastra przez użytkownika z niskimi uprawnieniami.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-78616 A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in… |
Pozostałe |
CVSS 4,8EPSS 0,3 % · nieaktualne | ||
| CVE-2026-78617 WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against… |
Pozostałe |
CVSS 6,3EPSS 0,42 % · nieaktualne | ||
| CVE-2026-78618 A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted… |
Pozostałe |
CVSS 6,9EPSS 0,43 % · nieaktualne | ||
| CVE-2026-78495 A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network… |
Pozostałe |
CVSS 5,3EPSS 0,39 % · nieaktualne | ||
| CVE-2026-78498 A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on… |
Pozostałe |
CVSS 5,1EPSS 0,44 % · nieaktualne | ||
| CVE-2026-78499 A server-side request forgery (SSRF) vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on… |
Pozostałe |
CVSS 5,1EPSS 0,44 % · nieaktualne | ||
| CVE-2026-78500 A blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network… |
Pozostałe |
CVSS 5,1EPSS 0,44 % · nieaktualne | ||
| CVE-2026-78047 A stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript… |
Pozostałe |
CVSS 5,1EPSS 0,44 % · nieaktualne | ||
| CVE-2026-78103 WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing… |
Pozostałe |
CVSS 5,1EPSS 0,49 % · nieaktualne | ||
| CVE-2026-38819 Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memory on the device within minutes. |
Pozostałe |
CVSS 5,3EPSS 0,26 % · nieaktualne | ||
| CVE-2026-61802 Wyciek klucza klastra w Wazuh umożliwia zdalne wykonanie kodu przez nieuprzywilejowane konto. |
PozostałePubliczny PoC |
CVSS 6,5EPSS 0,7 % · nieaktualne | ||
| CVE-2026-81845 A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function import_session/export_session of the file mcp_sequential_thinking/server.py of the… |
Pozostałe |
CVSS 2,1EPSS 0,5 % · nieaktualne | ||
| CVE-2026-81847 A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function save_pipeline/load_pipeline of the file pipeline_tools.py. Performing a… |
Pozostałe |
CVSS 2,0EPSS 0,35 % · nieaktualne | ||
| CVE-2026-81848 A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function s_fetch_page/s_fetch_pattern of the file… |
Pozostałe |
CVSS 5,1EPSS 0,35 % · nieaktualne | ||
| CVE-2026-81851 A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a… |
Pozostałe |
CVSS 6,9EPSS 0,41 % · nieaktualne | ||
| CVE-2026-81835 A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetch_instructions of the file malicious_mcp_server.py of the component MCP… |
Pozostałe |
CVSS 2,0EPSS 0,3 % · nieaktualne | ||
| CVE-2026-81836 A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAuth Callback.… |
Pozostałe |
CVSS 2,9EPSS 0,28 % · nieaktualne | ||
| CVE-2026-81837 A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This… |
Pozostałe |
CVSS 2,1EPSS 0,49 % · nieaktualne | ||
| CVE-2026-80179 A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the… |
Pozostałe |
CVSS 5,9EPSS 0,3 % · nieaktualne | ||
| CVE-2026-77341 cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without… |
Pozostałe |
CVSS 5,3EPSS 0,46 % · nieaktualne | ||
| CVE-2026-75548 The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted… |
Pozostałe |
CVSS 5,3EPSS 0,29 % · nieaktualne | ||
| CVE-2026-73839 Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the risk of credential compromise through visual or remote observation.… |
Pozostałe |
CVSS 5,1EPSS 0,2 % · nieaktualne | ||
| CVE-2026-71396 Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control. |
Pozostałe |
CVSS 5,3EPSS 0,24 % · nieaktualne | ||
| CVE-2026-54084 Błąd w Wazuh umożliwia atakującemu zdalne wywołanie awarii agenta, co prowadzi do odmowy usługi. |
PozostałePubliczny PoC |
CVSS 5,3EPSS 0,2 % · nieaktualne | ||
| CVE-2026-61783 Błąd w Wazuh pozwala na odczytanie tajnego klucza klastra przez użytkownika z niskimi uprawnieniami. |
PozostałePubliczny PoC |
CVSS 6,5EPSS 0,41 % · nieaktualne |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 07:02 UTC – 13.11.2026, 12:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.