Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,86 % · rekomendacja wg zapisanej polityki
In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method passes template widget attribute values directly into a…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,86 % · rekomendacja wg zapisanej polityki
A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
A vulnerability was found in TRENDnet TEW-755AP up to 20260702. Affected is the function FUN_401000 of the file /sbin/mycli. The manipulation of the argument ssid results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,85 % · rekomendacja wg zapisanej polityki
A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation of the argument Currenttime results in stack-based buffer overflow. The attack can be…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,85 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search. Successful attacks require…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://[::1]/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,86 % · rekomendacja wg zapisanej polityki
In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method passes template widget attribute values directly into a…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,86 % · rekomendacja wg zapisanej polityki
A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
A vulnerability was found in TRENDnet TEW-755AP up to 20260702. Affected is the function FUN_401000 of the file /sbin/mycli. The manipulation of the argument ssid results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,85 % · rekomendacja wg zapisanej polityki
A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation of the argument Currenttime results in stack-based buffer overflow. The attack can be…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,85 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search. Successful attacks require…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://[::1]/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki