Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str,…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Webserver crash caused by scanning on TCP port 80 in Softing Industrial Automation GmbH gateways and switch.This issue affects
smartLink HW-PN: from 1.02 through 1.03
smartLink HW-DP: 1.31
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READ_FILES permission could read or write another plugin's directory that merely…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the file_name argument passed to read_file, save_to_file, or run_python_file tool…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 1,26 % · rekomendacja wg zapisanej polityki
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Webserver crash caused by scanning on TCP port 80 in Softing Industrial Automation GmbH gateways and switch.This issue affects
smartLink HW-PN: from 1.02 through 1.03
smartLink HW-DP: 1.31
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READ_FILES permission could read or write another plugin's directory that merely…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the file_name argument passed to read_file, save_to_file, or run_python_file tool…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 1,26 % · rekomendacja wg zapisanej polityki
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki