KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
IBM Cloud Pak for Data System (Yosemite 1.0) 3.0.5.2 could allow a remote attacker to obtain sensitive information due to the use of weak or deprecated cryptographic protocols.
Nieprawidłowe neutralizowanie znaków w IBM DataStage umożliwia zdalne wykonanie poleceń OS.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
Luka w IBM DataStage pozwala zdalnemu uwierzytelnionemu atakującemu na manipulację plikami.
Nieprawidłowa walidacja ścieżek w IBM DataStage umożliwia zdalnemu atakującemu zapis dowolnych plików.
Nieprawidłowa konfiguracja silnika transformacji XSLT w IBM DataStage umożliwia zdalne wykonanie kodu.
Wstrzyknięcie poleceń w IBM DataStage umożliwia zdalne wykonanie dowolnych komend.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths.
ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer…
Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary…
PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the…
W module tarfile w CPython umożliwia złośliwym archiwum modyfikację plików poza katalogiem docelowym.
Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage.
DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all…
webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to…
Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender…
Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived from the agent name and a hash of the workload's runtime configuration. If a directory or FIFO…
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under…
Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the…
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in…
LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() incorporate filter…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-17467 IBM Cloud Pak for Data System (Yosemite 1.0) 3.0.5.2 could allow a remote attacker to obtain sensitive information due to the use of weak or deprecated cryptographic protocols. |
Monitoruj |
CVSS 8,2EPSS 0,28 % | ||
| CVE-2026-16673 Nieprawidłowe neutralizowanie znaków w IBM DataStage umożliwia zdalne wykonanie poleceń OS. |
Monitoruj |
CVSS 8,8EPSS 0,63 % | ||
| CVE-2026-17133 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special… |
Monitoruj |
CVSS 7,8EPSS 0,21 % | ||
| CVE-2026-17156 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization. |
Monitoruj |
CVSS 7,8EPSS 0,37 % | ||
| CVE-2026-17416 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization. |
Monitoruj |
CVSS 7,8EPSS 0,37 % | ||
| CVE-2026-16335 Luka w IBM DataStage pozwala zdalnemu uwierzytelnionemu atakującemu na manipulację plikami. |
Monitoruj |
CVSS 8,8EPSS 0,46 % | ||
| CVE-2026-16338 Nieprawidłowa walidacja ścieżek w IBM DataStage umożliwia zdalnemu atakującemu zapis dowolnych plików. |
Monitoruj |
CVSS 8,8EPSS 0,44 % | ||
| CVE-2026-16428 Nieprawidłowa konfiguracja silnika transformacji XSLT w IBM DataStage umożliwia zdalne wykonanie kodu. |
Monitoruj |
CVSS 8,8EPSS 0,81 % | ||
| CVE-2026-16466 Wstrzyknięcie poleceń w IBM DataStage umożliwia zdalne wykonanie dowolnych komend. |
Monitoruj |
CVSS 8,8EPSS 1,59 % | ||
| CVE-2026-15955 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths. |
Monitoruj |
CVSS 7,5EPSS 0,55 % | ||
| CVE-2026-89023 ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and… |
Monitoruj |
CVSS 8,8EPSS 0,39 % | ||
| CVE-2026-86830 Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with… |
Monitoruj |
CVSS 8,6EPSS 0,69 % | ||
| CVE-2026-82035 PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is… |
Monitoruj |
CVSS 7,1EPSS 0,32 % | ||
| CVE-2026-82049 W module tarfile w CPython umożliwia złośliwym archiwum modyfikację plików poza katalogiem docelowym. |
Monitoruj |
CVSS 8,4EPSS 0,19 % | ||
| CVE-2026-77884 Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory… |
Monitoruj |
CVSS 7,1EPSS 0,27 % | ||
| CVE-2026-90946 DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no… |
Monitoruj |
CVSS 8,7EPSS 0,51 % | ||
| CVE-2026-91080 webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers… |
Monitoruj |
CVSS 8,7EPSS 0,66 % | ||
| CVE-2026-90944 Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox.… |
Monitoruj |
CVSS 8,8EPSS 0,66 % | ||
| CVE-2026-85921 Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. |
Monitoruj |
CVSS 8,2EPSS 0,35 % | ||
| CVE-2026-86836 In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived from the agent name and a hash… |
Monitoruj |
CVSS 8,4EPSS 0,11 % | ||
| CVE-2026-85892 Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally. |
Monitoruj |
CVSS 7,8EPSS 0,2 % | ||
| CVE-2026-73494 blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the… |
Monitoruj |
CVSS 7,4EPSS 0,63 % | ||
| CVE-2026-70658 Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller… |
Monitoruj |
CVSS 7,4EPSS 0,58 % | ||
| CVE-2026-57577 DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment… |
Monitoruj |
CVSS 8,2EPSS 0,58 % | ||
| CVE-2026-55253 LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0,… |
Monitoruj |
CVSS 7,7EPSS 0,53 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 6.11.2026, 07:02 UTC – 6.11.2026, 12:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.