KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct…
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in…
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to…
Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft.
The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it…
Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of HTTP(S) content. A remote unauthenticated attacker can send a specially crafted HTTP(S) request to a specific endpoint…
An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST…
Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.
An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request.
CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in code_rag/entry/cli.py calls sync_dependencies for an indexed path, and code_rag/core/manager.py treats…
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second…
Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export_space and import_space in…
XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization…
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events…
OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several…
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a…
Nieprawidłowe warunki brzegowe w komponencie sieciowym w Firefox umożliwiają zdalne wykonanie kodu.
Błędne warunki graniczne w Safe Browsing w Firefox umożliwiają zdalne wykonanie kodu.
Eskalacja uprawnień w komponencie polityk przedsiębiorstwa w Firefox umożliwia nieautoryzowany dostęp.
Obejście zabezpieczeń w blokerze wyskakujących okienek w Firefox umożliwia nieautoryzowany dostęp.
Ucieczka z piaskownicy w komponencie Win32 Widget umożliwia zdalne wykonanie kodu.
Ucieczka z piaskownicy w komponencie Win32 Widget umożliwia nieautoryzowany dostęp do systemu.
Błąd use-after-free w komponencie Gtk umożliwia zdalne wykonanie kodu.
Błąd use-after-free w komponencie graficznym umożliwia zdalne wykonanie kodu.
Use-after-free w komponencie internacjonalizacji w Firefox umożliwia zdalne wykonanie kodu.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-55887 MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata… |
Monitoruj |
CVSS 8,7EPSS 0,22 % | ||
| CVE-2026-54076 ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public… |
Monitoruj |
CVSS 8,1EPSS 0,5 % | ||
| CVE-2026-54077 ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require… |
Monitoruj |
CVSS 7,1EPSS 0,45 % | ||
| CVE-2026-19407 Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution (RCE) and tenant-project… |
Monitoruj |
CVSS 7,7EPSS 0,67 % | ||
| CVE-2026-90650 The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' in all versions up to, and including, 6.2.4 due to… |
Monitoruj |
CVSS 7,2EPSS 0,4 % | ||
| CVE-2026-89025 Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of HTTP(S) content. A remote unauthenticated… |
Monitoruj |
CVSS 7,5EPSS 0,77 % | ||
| CVE-2026-88616 An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask,… |
Monitoruj |
CVSS 8,8EPSS 0,69 % | ||
| CVE-2026-79551 Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key. |
Monitoruj |
CVSS 7,5EPSS 0,3 % | ||
| CVE-2026-79425 An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request. |
Monitoruj |
CVSS 8,1EPSS 0,36 % | ||
| CVE-2026-57586 CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in code_rag/entry/cli.py calls… |
Monitoruj |
CVSS 8,6EPSS 0,21 % | ||
| CVE-2026-55178 GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource… |
Monitoruj |
CVSS 7,5EPSS 0,65 % | ||
| CVE-2026-53957 Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export_space and… |
Monitoruj |
CVSS 7,7EPSS 0,42 % | ||
| CVE-2026-53966 XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that… |
Monitoruj |
CVSS 7,1EPSS 0,77 % | ||
| CVE-2026-54167 Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts… |
Monitoruj |
CVSS 8,2EPSS 0,27 % | ||
| CVE-2026-16140 OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still… |
Monitoruj |
CVSS 8,8EPSS 0,39 % | ||
| CVE-2026-16141 OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the… |
Monitoruj |
CVSS 8,1EPSS 0,54 % | ||
| CVE-2026-92076 Nieprawidłowe warunki brzegowe w komponencie sieciowym w Firefox umożliwiają zdalne wykonanie kodu. |
Monitoruj |
CVSS 8,8EPSS 0,11 % | ||
| CVE-2026-92072 Błędne warunki graniczne w Safe Browsing w Firefox umożliwiają zdalne wykonanie kodu. |
Monitoruj |
CVSS 8,0EPSS 0,22 % | ||
| CVE-2026-92073 Eskalacja uprawnień w komponencie polityk przedsiębiorstwa w Firefox umożliwia nieautoryzowany dostęp. |
Monitoruj |
CVSS 8,8EPSS 0,22 % | ||
| CVE-2026-92074 Obejście zabezpieczeń w blokerze wyskakujących okienek w Firefox umożliwia nieautoryzowany dostęp. |
Monitoruj |
CVSS 8,8EPSS 0,11 % | ||
| CVE-2026-92064 Ucieczka z piaskownicy w komponencie Win32 Widget umożliwia zdalne wykonanie kodu. |
Monitoruj |
CVSS 8,8EPSS 0,1 % | ||
| CVE-2026-92065 Ucieczka z piaskownicy w komponencie Win32 Widget umożliwia nieautoryzowany dostęp do systemu. |
Monitoruj |
CVSS 8,8EPSS 0,1 % | ||
| CVE-2026-92067 Błąd use-after-free w komponencie Gtk umożliwia zdalne wykonanie kodu. |
Monitoruj |
CVSS 8,8EPSS 0,23 % | ||
| CVE-2026-92058 Błąd use-after-free w komponencie graficznym umożliwia zdalne wykonanie kodu. |
Monitoruj |
CVSS 8,8EPSS 0,23 % | ||
| CVE-2026-92060 Use-after-free w komponencie internacjonalizacji w Firefox umożliwia zdalne wykonanie kodu. |
Monitoruj |
CVSS 8,8EPSS 0,23 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 5.11.2026, 23:02 UTC – 6.11.2026, 00:32 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.