KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process.
GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR.
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted.
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root.
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root.
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied.
GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root.
GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root.
Wykonanie kodu z kontenera w crun umożliwia atakującemu uzyskanie uprawnień roota.
A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser function bhi385_parse_debug_message (located in bhi385_parse.c). The function parses FIFO events and extracts an 8-bit…
A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allows attackers to cause a denial of service (process crash) or potentially execute arbitrary code. The bridge…
A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function…
A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding…
Obejście uwierzytelnienia w Apache Camel K pozwala na dostęp do tajemnic innych najemców.
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will,…
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A…
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key…
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than…
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer…
Przepełnienie bufora w Nintendo Switch umożliwia zdalne wykonanie kodu przez atakującego.
Przepełnienie bufora w Palo Alto Networks PAN-OS umożliwia zdalne wykonanie kodu lub DoS.
Atakujący zdalny bez uwierzytelnienia może odkryć szczegóły węzłów klastra w Apache Artemis.
Nieautoryzowany atakujący może tworzyć dowolne kolejki w Apache Artemis, co prowadzi do manipulacji stanem brokera.
The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sbm_description' parameter in all versions up to, and including, 1.18 due to insufficient input sanitization and output escaping. This makes it possible for…
Wtyczka Bulk Password Reset dla WordPressa umożliwia eskalację uprawnień przez przejęcie konta.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-88287 GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and… |
Monitoruj |
CVSS 7,5EPSS 0,55 % | ||
| CVE-2026-88271 GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR. |
Monitoruj |
CVSS 8,8EPSS 0,42 % | ||
| CVE-2026-88272 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted. |
Monitoruj |
CVSS 7,2EPSS 0,54 % | ||
| CVE-2026-88273 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root. |
Monitoruj |
CVSS 7,2EPSS 0,71 % | ||
| CVE-2026-88274 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root. |
Monitoruj |
CVSS 7,2EPSS 0,71 % | ||
| CVE-2026-88275 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied. |
Monitoruj |
CVSS 7,2EPSS 0,71 % | ||
| CVE-2026-88276 GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root. |
Monitoruj |
CVSS 7,2EPSS 0,71 % | ||
| CVE-2026-88277 GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root. |
Monitoruj |
CVSS 8,8EPSS 0,65 % | ||
| CVE-2026-84042 Wykonanie kodu z kontenera w crun umożliwia atakującemu uzyskanie uprawnień roota. |
Monitoruj |
CVSS 7,8EPSS 0,1 % | ||
| CVE-2026-42805 A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser function bhi385_parse_debug_message (located in… |
Monitoruj |
CVSS 8,4EPSS 0,19 % | ||
| CVE-2026-42807 A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allows attackers to cause a denial of service… |
Monitoruj |
CVSS 8,0EPSS 0,31 % | ||
| CVE-2026-42804 A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a. The vulnerability is located… |
Monitoruj |
CVSS 7,6EPSS 0,25 % | ||
| CVE-2026-13745 A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The… |
Monitoruj |
CVSS 7,7EPSS 0,65 % | ||
| CVE-2026-80354 Obejście uwierzytelnienia w Apache Camel K pozwala na dostęp do tajemnic innych najemców. |
Monitoruj |
CVSS 8,1EPSS 0,5 % | ||
| CVE-2026-77771 The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it… |
Monitoruj |
CVSS 7,5EPSS 0,32 % | ||
| CVE-2026-81431 The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the… |
Monitoruj |
CVSS 7,2EPSS 0,46 % | ||
| CVE-2026-82925 The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce… |
Monitoruj |
CVSS 8,1EPSS 0,45 % | ||
| CVE-2026-19436 The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout,… |
Monitoruj |
CVSS 7,5EPSS 0,36 % | ||
| CVE-2026-19439 The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve… |
Monitoruj |
CVSS 7,5EPSS 0,43 % | ||
| CVE-2026-82079 Przepełnienie bufora w Nintendo Switch umożliwia zdalne wykonanie kodu przez atakującego. |
Monitoruj |
CVSS 7,0EPSS 0,26 % | ||
| CVE-2026-0310 Przepełnienie bufora w Palo Alto Networks PAN-OS umożliwia zdalne wykonanie kodu lub DoS. |
Monitoruj |
CVSS 7,2EPSS 0,67 % | ||
| CVE-2026-49363 Atakujący zdalny bez uwierzytelnienia może odkryć szczegóły węzłów klastra w Apache Artemis. |
Monitoruj |
CVSS 7,5EPSS 0,8 % | ||
| CVE-2026-49362 Nieautoryzowany atakujący może tworzyć dowolne kolejki w Apache Artemis, co prowadzi do manipulacji stanem brokera. |
Monitoruj |
CVSS 7,5EPSS 0,82 % | ||
| CVE-2026-76562 The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sbm_description' parameter in all versions up to, and including, 1.18 due to… |
Monitoruj |
CVSS 7,2EPSS 0,4 % | ||
| CVE-2026-14873 Wtyczka Bulk Password Reset dla WordPressa umożliwia eskalację uprawnień przez przejęcie konta. |
Monitoruj |
CVSS 8,0EPSS 0,42 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 11.11.2026, 03:32 UTC – 11.11.2026, 05:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.