KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after…
Eskalacja uprawnień w urządzeniach Teltonika umożliwia niżej uprzywilejowanemu użytkownikowi uzyskanie dostępu administracyjnego.
Certain HP DesignJet products may be potentially vulnerable to cross-site scripting (XSS), which may allow unauthenticated HTTP requests to view print job previews.
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing…
Niewystarczająca kontrola dostępu w Davantis DDFUSION pozwala nieautoryzowanym użytkownikom na dostęp do ustawień kamer.
Podatność w pluginie Grav API umożliwia atakującym obejście walidacji hosta przez DNS rebinding.
traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an…
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template…
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where…
Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information…
Błąd w Hospital Manager Backend Services ujawnia szczegóły konfiguracji, co ułatwia ataki.
Wstrzyknięcie nowej linii w rsync umożliwia lokalnym atakującym fałszowanie komunikatów protokołu.
Błąd w weryfikacji podpisu webhooka w Appwrite pozwala na nieautoryzowane publikowanie komentarzy.
Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to conditions for a Denial-of-Service attack.
Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23.
OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a _queryFilter naming another realm to disclose…
A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely.
Nieprawidłowa walidacja wejścia w BlackBerry UEM umożliwia pobieranie plików i potencjalne DoS.
Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix…
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array,…
Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.
Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute…
Brak ograniczeń w Frappe pozwala na wykorzystanie uprawnień ofiary do akceptacji workflow.
Brak walidacji nagłówków HTTP w MCP Ruby SDK umożliwia atak DNS rebinding na lokalny serwer.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. | Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after… |
Do wiadomości | 6,9 | 0,29 % | ||
| Eskalacja uprawnień w urządzeniach Teltonika umożliwia niżej uprzywilejowanemu użytkownikowi uzyskanie dostępu administracyjnego. | Eskalacja uprawnień w urządzeniach Teltonika umożliwia niżej uprzywilejowanemu użytkownikowi uzyskanie dostępu administracyjnego. |
Do wiadomości | 6,9 | 0,29 % | ||
| Certain HP DesignJet products may be potentially vulnerable to cross-site scripting (XSS), which may allow unauthenticated HTTP requests… | Certain HP DesignJet products may be potentially vulnerable to cross-site scripting (XSS), which may allow unauthenticated HTTP requests to view print job previews. |
Do wiadomości | 6,9 | 0,29 % | ||
| An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. | An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing… |
Do wiadomości | 6,9 | 0,29 % | ||
| Niewystarczająca kontrola dostępu w Davantis DDFUSION pozwala nieautoryzowanym użytkownikom na dostęp do ustawień kamer. | Niewystarczająca kontrola dostępu w Davantis DDFUSION pozwala nieautoryzowanym użytkownikom na dostęp do ustawień kamer. |
Do wiadomości | 6,9 | 0,29 % | ||
| Podatność w pluginie Grav API umożliwia atakującym obejście walidacji hosta przez DNS rebinding. | Podatność w pluginie Grav API umożliwia atakującym obejście walidacji hosta przez DNS rebinding. |
Do wiadomości | 6,9 | 0,28 % | ||
| traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution… | traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an… |
Do wiadomości | 6,9 | 0,28 % | ||
| NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can… | NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template… |
Do wiadomości | 6,9 | 0,28 % | ||
| Payload is a free and open source headless content management system. | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where… |
Do wiadomości | 6,9 | 0,28 % | ||
| Payload is a free and open source headless content management system. | Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information… |
Do wiadomości | 6,9 | 0,28 % | ||
| Błąd w Hospital Manager Backend Services ujawnia szczegóły konfiguracji, co ułatwia ataki. | Błąd w Hospital Manager Backend Services ujawnia szczegóły konfiguracji, co ułatwia ataki. |
Do wiadomości | 6,9 | 0,27 % | ||
| Wstrzyknięcie nowej linii w rsync umożliwia lokalnym atakującym fałszowanie komunikatów protokołu. | Wstrzyknięcie nowej linii w rsync umożliwia lokalnym atakującym fałszowanie komunikatów protokołu. |
Do wiadomości | 6,9 | 0,27 % | ||
| Błąd w weryfikacji podpisu webhooka w Appwrite pozwala na nieautoryzowane publikowanie komentarzy. | Błąd w weryfikacji podpisu webhooka w Appwrite pozwala na nieautoryzowane publikowanie komentarzy. |
Do wiadomości | 6,9 | 0,27 % | ||
| Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM),… | Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to conditions for a Denial-of-Service attack. |
Do wiadomości | 6,9 | 0,27 % | ||
| Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly… | Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23. |
Do wiadomości | 6,9 | 0,27 % | ||
| OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm… | OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a _queryFilter naming another realm to disclose… |
Do wiadomości | 6,9 | 0,26 % | ||
| A vulnerability was found in SourceCodester Simple Student Information System 1.0. | A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely. |
Do wiadomości | 6,9 | 0,26 % | ||
| Nieprawidłowa walidacja wejścia w BlackBerry UEM umożliwia pobieranie plików i potencjalne DoS. | Nieprawidłowa walidacja wejścia w BlackBerry UEM umożliwia pobieranie plików i potencjalne DoS. |
Do wiadomości | 6,9 | 0,26 % | ||
| Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured… | Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3. |
Do wiadomości | 6,9 | 0,26 % | ||
| The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix… |
Do wiadomości | 6,9 | 0,26 % | ||
| Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The… | Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array,… |
Do wiadomości | 6,9 | 0,26 % | ||
| Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing… | Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP. |
Do wiadomości | 6,9 | 0,26 % | ||
| Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. | Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute… |
Do wiadomości | 6,9 | 0,26 % | ||
| Brak ograniczeń w Frappe pozwala na wykorzystanie uprawnień ofiary do akceptacji workflow. | Brak ograniczeń w Frappe pozwala na wykorzystanie uprawnień ofiary do akceptacji workflow. |
Do wiadomości | 6,9 | 0,26 % | ||
| Brak walidacji nagłówków HTTP w MCP Ruby SDK umożliwia atak DNS rebinding na lokalny serwer. | Brak walidacji nagłówków HTTP w MCP Ruby SDK umożliwia atak DNS rebinding na lokalny serwer. |
Do wiadomości | 6,9 | 0,26 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.