Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| devtools-vite | CVE-2026-78177 A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command… |
1,1 | 0,9 % | Brak wpisu w KEV nie wyklucza ataków | |
| jQWidgets | CVE-2026-78178 A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The… |
6,9 | 0,59 % | Brak wpisu w KEV nie wyklucza ataków | |
| Sales and Inventory System | CVE-2026-78171 A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/processlogin.php. The manipulation of the argument User leads to sql injection. It is possible to initiate the attack remotely. The exploit… |
5,5 | 0,43 % | Brak wpisu w KEV nie wyklucza ataków | |
| kafka-ui | CVE-2026-78166 A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in code… |
2,1 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków | |
| ERP | CVE-2026-78160 A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading… |
2,1 | 0,39 % | Brak wpisu w KEV nie wyklucza ataków | |
| libwebsockets | CVE-2026-78161 A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. The manipulation results in out-of-bounds write. The attack can be launched remotely. The exploit has been made public and could be… |
5,5 | 0,4 % | Brak wpisu w KEV nie wyklucza ataków | |
| Ghostwriter | CVE-2026-78204 Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only request.user.is_active unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored… |
5,3 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| BentoML | CVE-2026-78205 BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space (100.64.0.0/10, CGNAT). In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs… |
6,9 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków | |
| Open5GS | CVE-2026-78157 A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The patch is named… |
2,1 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| Open5GS | CVE-2026-78158 A flaw has been found in Open5GS 2.8.0. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. |
2,1 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| Open5GS | CVE-2026-78156 A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hss_ogs_diam_s6a_air_cb of the file src/hss/hss-s6a-path.c of the component S6a Authentication-Information-Request Handler. Such manipulation of the argument Visited-PLMN-Id leads to heap-based… |
2,1 | 0,56 % | Brak wpisu w KEV nie wyklucza ataków | |
| llama.cpp | CVE-2026-78148 A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The… |
6,9 | 0,72 % | Brak wpisu w KEV nie wyklucza ataków | |
| CTFd | CVE-2026-78145 A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__init__.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and… |
2,1 | 0,56 % | Brak wpisu w KEV nie wyklucza ataków | |
| llama.cpp | CVE-2026-78147 A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/op_params results in deserialization. The attack may be… |
6,9 | 0,56 % | Brak wpisu w KEV nie wyklucza ataków | |
| Barangay Resident Profiling Management System | CVE-2026-78144 A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /boarders.php of the component Boarder Management Module. Such manipulation of the argument ID leads to authorization bypass.… |
2,1 | 0,38 % | Brak wpisu w KEV nie wyklucza ataków | |
| Barangay Resident Profiling Management System | CVE-2026-78143 A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the… |
5,5 | 0,43 % | Brak wpisu w KEV nie wyklucza ataków | |
| CH22 | CVE-2026-78141 A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
2,1 | 2,75 % | Brak wpisu w KEV nie wyklucza ataków | |
| Barangay Resident Profiling Management System | CVE-2026-78142 A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. This impacts an unknown function of the file /archived_records.php of the component Restore/Delete. The manipulation of the argument resident_id results in authorization bypass. The attack may be launched… |
2,1 | 0,38 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache-AppSamurai | CVE-2026-19565 Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running… |
3,7 | 0,44 % | Brak wpisu w KEV nie wyklucza ataków | |
| UJCMS | CVE-2026-78140 A flaw has been found in Dromara UJCMS up to 10.1.3. The impacted element is the function update of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component web-file-template Endpoint. Executing a manipulation can lead to improper neutralization of… |
2,0 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków | |
| Reverse-Proxy | CVE-2026-75922 Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line. PSGI hands PATH_INFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees… |
5,3 | 0,42 % | Brak wpisu w KEV nie wyklucza ataków | |
| justhtml | CVE-2026-8630 justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in the serialization of raw-text elements such as <style> and <script>. When a DOM tree is processed by sanitize_dom() using a custom policy that keeps these elements, text nodes inside them… |
5,1 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| justhtml | CVE-2026-74793 justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling… |
5,1 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| justhtml | CVE-2026-77088 Wykryta luka XSS w justhtml umożliwia atakującym wstrzykiwanie niebezpiecznego kodu. |
5,3 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| justhtml | CVE-2026-5389 justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the… |
5,1 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 23:02 UTC – 14.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.