KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer could allow an authenticated attacker to…
IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 is vulnerable to an XML external entity injection (XXE) attack…
IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default.
Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated…
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and confluence_upload_attachments tools pass a client-controlled file_path through…
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence…
SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted bytes without…
garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmin_tokens.json without explicit owner-only modes, so a…
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as json_reader and log_reader through its unauthenticated MySQL-compatible server port without restricting outbound…
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without authentication, authorization, or…
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting…
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate…
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its…
IBM Cloud Pak for Data System (Yosemite 1.0) 3.0.5.2 could allow a remote attacker to obtain sensitive information due to the use of weak or deprecated cryptographic protocols.
Nieprawidłowe neutralizowanie znaków w IBM DataStage umożliwia zdalne wykonanie poleceń OS.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
Luka w IBM DataStage pozwala zdalnemu uwierzytelnionemu atakującemu na manipulację plikami.
Nieprawidłowa walidacja ścieżek w IBM DataStage umożliwia zdalnemu atakującemu zapis dowolnych plików.
Nieprawidłowa konfiguracja silnika transformacji XSLT w IBM DataStage umożliwia zdalne wykonanie kodu.
Wstrzyknięcie poleceń w IBM DataStage umożliwia zdalne wykonanie dowolnych komend.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths.
ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-13275 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and… |
Monitoruj |
CVSS 7,1EPSS 0,32 % | ||
| CVE-2026-13285 IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or… |
Monitoruj |
CVSS 7,1EPSS 0,5 % | ||
| CVE-2026-13287 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and… |
Monitoruj |
CVSS 7,1EPSS 0,5 % | ||
| CVE-2026-13107 IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default. |
Monitoruj |
CVSS 7,1EPSS 0,36 % | ||
| CVE-2026-82028 Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by… |
Monitoruj |
CVSS 8,7EPSS 0,6 % | ||
| CVE-2026-73496 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and confluence_upload_attachments… |
Monitoruj |
CVSS 7,7EPSS 0,48 % | ||
| CVE-2026-65838 Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an… |
Monitoruj |
CVSS 8,2EPSS 0,46 % | ||
| CVE-2026-54632 SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and… |
Monitoruj |
CVSS 7,5EPSS 0,72 % | ||
| CVE-2026-54447 garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token… |
Monitoruj |
CVSS 8,4EPSS 0,15 % | ||
| CVE-2026-54628 Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as json_reader and log_reader through its… |
Monitoruj |
CVSS 8,6EPSS 0,6 % | ||
| CVE-2026-54629 Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its… |
Monitoruj |
CVSS 7,5EPSS 0,97 % | ||
| CVE-2026-47253 Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the caller-controlled… |
Monitoruj |
CVSS 7,3EPSS 0,44 % | ||
| CVE-2026-19624 A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that… |
Monitoruj |
CVSS 7,8EPSS 0,13 % | ||
| CVE-2026-19816 A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores… |
Monitoruj |
CVSS 7,1EPSS 0,14 % | ||
| CVE-2026-17467 IBM Cloud Pak for Data System (Yosemite 1.0) 3.0.5.2 could allow a remote attacker to obtain sensitive information due to the use of weak or deprecated cryptographic protocols. |
Monitoruj |
CVSS 8,2EPSS 0,28 % | ||
| CVE-2026-16673 Nieprawidłowe neutralizowanie znaków w IBM DataStage umożliwia zdalne wykonanie poleceń OS. |
Monitoruj |
CVSS 8,8EPSS 0,63 % | ||
| CVE-2026-17133 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special… |
Monitoruj |
CVSS 7,8EPSS 0,21 % | ||
| CVE-2026-17156 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization. |
Monitoruj |
CVSS 7,8EPSS 0,37 % | ||
| CVE-2026-17416 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization. |
Monitoruj |
CVSS 7,8EPSS 0,37 % | ||
| CVE-2026-16335 Luka w IBM DataStage pozwala zdalnemu uwierzytelnionemu atakującemu na manipulację plikami. |
Monitoruj |
CVSS 8,8EPSS 0,46 % | ||
| CVE-2026-16338 Nieprawidłowa walidacja ścieżek w IBM DataStage umożliwia zdalnemu atakującemu zapis dowolnych plików. |
Monitoruj |
CVSS 8,8EPSS 0,44 % | ||
| CVE-2026-16428 Nieprawidłowa konfiguracja silnika transformacji XSLT w IBM DataStage umożliwia zdalne wykonanie kodu. |
Monitoruj |
CVSS 8,8EPSS 0,81 % | ||
| CVE-2026-16466 Wstrzyknięcie poleceń w IBM DataStage umożliwia zdalne wykonanie dowolnych komend. |
Monitoruj |
CVSS 8,8EPSS 1,59 % | ||
| CVE-2026-15955 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths. |
Monitoruj |
CVSS 7,5EPSS 0,55 % | ||
| CVE-2026-89023 ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and… |
Monitoruj |
CVSS 8,8EPSS 0,39 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 6.11.2026, 03:02 UTC – 6.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.