Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Red Hat Hardened Images / lvm2 / Red Hat OpenShift Container Platform 4 (+1 produktów) | CVE-2026-19617 Błąd w libdm pozwala na atak DoS poprzez złośliwą konfigurację LVM. |
5,5 | 0,16 % | Brak wpisu w KEV nie wyklucza ataków | |
| Epeken All Kurir for Woocommerce | CVE-2026-16739 Brak weryfikacji potwierdzenia płatności w wtyczce Epeken All Kurir umożliwia atakującym fałszowanie statusów zamówień. |
5,9 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder | CVE-2026-16810 The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'data[queryCondition]' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied… |
6,5 | 0,45 % | Brak wpisu w KEV nie wyklucza ataków | |
| Embed Google Photos album | CVE-2026-14290 The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including… |
6,8 | 0,43 % | Brak wpisu w KEV nie wyklucza ataków | |
| affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display | CVE-2026-12743 The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient… |
4,9 | 0,44 % | Brak wpisu w KEV nie wyklucza ataków | |
| Astro Booking Engine | CVE-2025-10308 The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings… |
4,3 | 0,18 % | Brak wpisu w KEV nie wyklucza ataków | |
| RosarioSIS | CVE-2026-19784 A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is… |
2,1 | 0,46 % | Brak wpisu w KEV nie wyklucza ataków | |
| RosarioSIS | CVE-2026-19785 A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be… |
5,3 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| RosarioSIS | CVE-2026-19786 A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressing… |
5,3 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| Air Cargo Management System | CVE-2026-19787 A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_cargo_type. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been… |
2,0 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| fm-mcp-servers | CVE-2026-19770 A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The… |
1,9 | 0,15 % | Brak wpisu w KEV nie wyklucza ataków | |
| Hospital Management System | CVE-2026-19767 A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Executing a manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been made… |
2,1 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| Taier | CVE-2026-19762 A vulnerability was found in DTStack Taier 1.4.0. Affected by this vulnerability is the function Paths.ge of the file FileChunkController.java of the component Chunk-Check Endpoint. The manipulation of the argument Name results in path traversal. The attack may be launched remotely. The exploit… |
5,5 | 0,62 % | Brak wpisu w KEV nie wyklucza ataków | |
| Taier | CVE-2026-19763 A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the component Cluster Creation. This manipulation of the argument clusterName causes path traversal. Remote exploitation of the attack is… |
5,1 | 0,56 % | Brak wpisu w KEV nie wyklucza ataków | |
| Communication Command and Dispatch Management Platform | CVE-2026-19764 A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/users/getpwd.php. Such manipulation of the argument sip leads to sql injection. The attack can be executed remotely. The exploit is publicly… |
5,5 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków | |
| swagger-testcase-mcp | CVE-2026-19765 A security flaw has been discovered in eyaushev swagger-testcase-mcp 5babb27c951fb404bc2b25ec80593616e49054e5. This vulnerability affects the function loadSource of the file src/utils/swagger-parser.ts of the component fetch_swagger. Performing a manipulation results in server-side request… |
2,1 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| lamp-cloud | CVE-2026-19758 A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely.… |
5,5 | 0,62 % | Brak wpisu w KEV nie wyklucza ataków | |
| Taier | CVE-2026-19761 A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to… |
5,1 | 0,51 % | Brak wpisu w KEV nie wyklucza ataków | |
| lamp-cloud | CVE-2026-19757 A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated… |
5,5 | 0,62 % | Brak wpisu w KEV nie wyklucza ataków | |
| mcp-rdf-explorer | CVE-2026-19753 A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be… |
5,5 | 0,47 % | Brak wpisu w KEV nie wyklucza ataków | |
| lamp-cloud | CVE-2026-19756 A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code Generator. Such manipulation of the argument outputDir/parent/projectPrefix leads to path traversal. It is possible to launch the attack… |
2,1 | 0,43 % | Brak wpisu w KEV nie wyklucza ataków | |
| openchoreo | CVE-2026-73840 Brak uwierzytelnienia w OpenChoreo pozwala na nieautoryzowane wyzwalanie budów. |
5,3 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| trigger.dev | CVE-2026-73657 Brak filtru runtimeEnvironmentId w Trigger.dev pozwala na odtwarzanie zadań innych użytkowników. |
4,2 | 0,18 % | Brak wpisu w KEV nie wyklucza ataków | |
| framework | CVE-2026-73661 Błąd w FreePBX pozwala na obejście uwierzytelnienia przez przywrócenie ustawienia AUTHTYPE=none. |
6,5 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| trix | CVE-2026-73428 Wstrzyknięcie skryptu w Trix umożliwia wykonanie kodu JavaScript przez innego użytkownika. |
4,6 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 14.11.2026, 15:02 UTC – 14.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.