Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to SQL Injection via the donation_ids parameter in all versions up to, and including, 1.8.8.4 due to insufficient escaping on the user supplied parameter and lack of…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Assets product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Assets. Successful…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts) allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint (GET /api/v1/fleet/mdm/apple/commands) allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to SQL Injection via the donation_ids parameter in all versions up to, and including, 1.8.8.4 due to insufficient escaping on the user supplied parameter and lack of…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Assets product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Assets. Successful…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts) allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint (GET /api/v1/fleet/mdm/apple/commands) allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki