KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this…
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this…
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this…
Wrażliwość na bezpieczeństwo pamięci w VLC media player może prowadzić do wykonania kodu.
Podatność w PocketMine-MP powoduje awarię serwera przy nieprawidłowej wartości slotu inwentarza.
Podatność w PocketMine-MP umożliwia zdalne zablokowanie serwera przez wysłanie uszkodzonych danych JSON.
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance,…
PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack…
PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login…
PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the…
Błąd w PocketMine-MP pozwala na awarię serwera przez wysłanie niepoprawnych danych NBT.
Błąd w analizie JSON w PocketMine-MP pozwala na zdalne zablokowanie serwera.
PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.
A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP). Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could…
Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP…
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that…
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that…
W SiYuan przed wersją 3.8.2 występuje podatność na XSS, umożliwiająca wykonanie JavaScriptu.
Wykorzystanie podatności w SiYuan pozwala na usunięcie plików poza katalogiem roboczym.
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views limits. Attackers can send concurrent requests to the show endpoint to access…
Błąd w GitPython umożliwia atakującym odczytanie dowolnych ścieżek systemowych.
siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls…
SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The prior fix (commit d5e2d0bc) added an administrator check for SQL mode (method=2) in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce…
Błąd w Siyuan umożliwia atakującym dostęp do prywatnych bloków w publicznych dokumentach.
SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft malicious template paths that break out of the attribute context and execute JavaScript when a victim opens…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-79740 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated… |
Monitoruj |
CVSS 7,5EPSS 0,41 % | ||
| CVE-2026-79950 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated… |
Monitoruj |
CVSS 7,5EPSS 0,41 % | ||
| CVE-2026-79738 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated… |
Monitoruj |
CVSS 7,5EPSS 0,41 % | ||
| CVE-2026-56711 Wrażliwość na bezpieczeństwo pamięci w VLC media player może prowadzić do wykonania kodu. |
Monitoruj |
CVSS 7,3EPSS 0,12 % | ||
| CVE-2024-58380 Podatność w PocketMine-MP powoduje awarię serwera przy nieprawidłowej wartości slotu inwentarza. |
Monitoruj |
CVSS 7,1EPSS 0,53 % | ||
| CVE-2024-58381 Podatność w PocketMine-MP umożliwia zdalne zablokowanie serwera przez wysłanie uszkodzonych danych JSON. |
Monitoruj |
CVSS 8,7EPSS 0,78 % | ||
| CVE-2024-58382 league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit… |
Monitoruj |
CVSS 8,7EPSS 0,49 % | ||
| CVE-2025-71417 PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to trigger duplicate… |
Monitoruj |
CVSS 7,1EPSS 0,44 % | ||
| CVE-2023-54355 PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets… |
Monitoruj |
CVSS 8,7EPSS 0,38 % | ||
| CVE-2023-54390 PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send… |
Monitoruj |
CVSS 8,7EPSS 0,61 % | ||
| CVE-2023-54392 Błąd w PocketMine-MP pozwala na awarię serwera przez wysłanie niepoprawnych danych NBT. |
Monitoruj |
CVSS 7,1EPSS 0,53 % | ||
| CVE-2023-54393 Błąd w analizie JSON w PocketMine-MP pozwala na zdalne zablokowanie serwera. |
Monitoruj |
CVSS 8,7EPSS 0,63 % | ||
| CVE-2023-54396 PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via… |
Monitoruj |
CVSS 7,1EPSS 0,53 % | ||
| CVE-2026-15140 A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP). Only under specific conditions during the initial provisioning of a Portworx storage… |
Monitoruj |
CVSS 7,7EPSS 0,35 % | ||
| CVE-2026-87821 Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch… |
Monitoruj |
CVSS 7,1EPSS 0,47 % | ||
| CVE-2026-87812 SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without… |
Monitoruj |
CVSS 7,4EPSS 0,36 % | ||
| CVE-2026-87813 SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated… |
Monitoruj |
CVSS 8,4EPSS 0,37 % | ||
| CVE-2026-87814 W SiYuan przed wersją 3.8.2 występuje podatność na XSS, umożliwiająca wykonanie JavaScriptu. |
Monitoruj |
CVSS 8,4EPSS 0,37 % | ||
| CVE-2026-87815 Wykorzystanie podatności w SiYuan pozwala na usunięcie plików poza katalogiem roboczym. |
Monitoruj |
CVSS 8,4EPSS 0,48 % | ||
| CVE-2026-87816 PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views limits.… |
Monitoruj |
CVSS 8,7EPSS 0,37 % | ||
| CVE-2026-87818 Błąd w GitPython umożliwia atakującym odczytanie dowolnych ścieżek systemowych. |
MonitorujPubliczny PoC |
CVSS 7,1EPSS 0,41 % | ||
| CVE-2026-87807 siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT… |
Monitoruj |
CVSS 8,7EPSS 0,45 % | ||
| CVE-2026-87808 SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The prior fix (commit d5e2d0bc) added an administrator check for SQL mode (method=2) in POST… |
Monitoruj |
CVSS 8,7EPSS 0,44 % | ||
| CVE-2026-87809 Błąd w Siyuan umożliwia atakującym dostęp do prywatnych bloków w publicznych dokumentach. |
Monitoruj |
CVSS 7,1EPSS 0,35 % | ||
| CVE-2026-87811 SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft malicious template paths that break… |
Monitoruj |
CVSS 8,4EPSS 0,37 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 11.11.2026, 07:02 UTC – 11.11.2026, 08:32 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.