KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Niewystarczająco chronione dane uwierzytelniające w Rently Smart Home umożliwiają dostęp do kodów PIN.
XSS w NukeViet CMS pozwala na zdalne wykonanie złośliwego kodu przez anonimowych użytkowników.
Wykonanie złośliwego kodu w CtrlPanel umożliwia atakującemu przejęcie sesji administratora.
A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is…
A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response.
A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface.
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects,…
Wykryta podatność w kafka-python umożliwia atak DoS przez złośliwego brokera.
99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing…
Improper input validation for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege.…
thread-amount is a tool that gets the amount of threads in the current process. Prior to version 0.2.2, there are resource leaks when querying thread counts on Windows and Apple platforms. In Windows platforms, the thread_amount function calls CreateToolhelp32Snapshot but fails to close the…
Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the…
Podatność w AMPPS 2.7 umożliwia zdalnym atakującym zdalne zablokowanie usługi.
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to…
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal…
CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated attackers can send specially crafted traffic to the server and cause a persistent denial of service.
Wstrzyknięcie SQL w Coverity Connect umożliwia nieautoryzowany dostęp do bazy danych.
Nieprawidłowe przetwarzanie uszkodzonych pakietów CIP powoduje awarię kontrolera i jego unieruchomienie.
vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac,…
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the…
JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.
MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.
MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating…
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Niewystarczająco chronione dane uwierzytelniające w Rently Smart Home umożliwiają dostęp do kodów PIN. | Niewystarczająco chronione dane uwierzytelniające w Rently Smart Home umożliwiają dostęp do kodów PIN. |
Obserwuj | 8,7 | 0,35 % | ||
| XSS w NukeViet CMS pozwala na zdalne wykonanie złośliwego kodu przez anonimowych użytkowników. | XSS w NukeViet CMS pozwala na zdalne wykonanie złośliwego kodu przez anonimowych użytkowników. |
Obserwuj | 8,7 | 0,35 % | ||
| Wykonanie złośliwego kodu w CtrlPanel umożliwia atakującemu przejęcie sesji administratora. | Wykonanie złośliwego kodu w CtrlPanel umożliwia atakującemu przejęcie sesji administratora. |
Obserwuj | 8,7 | 0,35 % | ||
| A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation… | A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is… |
Obserwuj | 8,7 | 0,35 % | ||
| A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a… | A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response. |
Obserwuj | 8,7 | 0,35 % | ||
| A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an… | A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface. |
Obserwuj | 8,7 | 0,35 % | ||
| Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block… | Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects,… |
Obserwuj | 8,7 | 0,35 % | ||
| Wykryta podatność w kafka-python umożliwia atak DoS przez złośliwego brokera. | Wykryta podatność w kafka-python umożliwia atak DoS przez złośliwego brokera. |
Obserwuj | 8,7 | 0,35 % | ||
| 99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated… | 99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing… |
Obserwuj | 8,7 | 0,35 % | ||
| Improper input validation for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an… | Improper input validation for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege.… |
Obserwuj | 8,7 | 0,35 % | ||
| thread-amount is a tool that gets the amount of threads in the current process. | thread-amount is a tool that gets the amount of threads in the current process. Prior to version 0.2.2, there are resource leaks when querying thread counts on Windows and Apple platforms. In Windows platforms, the thread_amount function calls CreateToolhelp32Snapshot but fails to close the… |
Obserwuj | 8,7 | 0,35 % | ||
| Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote… | Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the… |
Obserwuj | 8,7 | 0,35 % | ||
| Podatność w AMPPS 2.7 umożliwia zdalnym atakującym zdalne zablokowanie usługi. | Podatność w AMPPS 2.7 umożliwia zdalnym atakującym zdalne zablokowanie usługi. |
Obserwuj | 8,7 | 0,35 % | ||
| Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to… | Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to… |
Obserwuj | 8,7 | 0,34 % | ||
| A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal… |
Obserwuj | 8,7 | 0,34 % | ||
| CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated… | CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated attackers can send specially crafted traffic to the server and cause a persistent denial of service. |
Obserwuj | 8,7 | 0,34 % | ||
| Wstrzyknięcie SQL w Coverity Connect umożliwia nieautoryzowany dostęp do bazy danych. | Wstrzyknięcie SQL w Coverity Connect umożliwia nieautoryzowany dostęp do bazy danych. |
Obserwuj | 8,7 | 0,34 % | ||
| Nieprawidłowe przetwarzanie uszkodzonych pakietów CIP powoduje awarię kontrolera i jego unieruchomienie. | Nieprawidłowe przetwarzanie uszkodzonych pakietów CIP powoduje awarię kontrolera i jego unieruchomienie. |
Obserwuj | 8,7 | 0,34 % | ||
| vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal… | vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac,… |
Obserwuj | 8,7 | 0,34 % | ||
| phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search… | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the… |
Obserwuj | 8,7 | 0,34 % | ||
| JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream. | JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream. |
Obserwuj | 8,7 | 0,34 % | ||
| MP4Parser does not adequately validate MP4 box sizes. | MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input. |
Obserwuj | 8,7 | 0,34 % | ||
| MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. | MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying. |
Obserwuj | 8,7 | 0,34 % | ||
| Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom… | Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating… |
Obserwuj | 8,7 | 0,34 % | ||
| Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. | Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated… |
Obserwuj | 8,7 | 0,34 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.