KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to its…
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate…
Błąd w Bouncy Castle dla Javy pozwala na ujawnienie kluczy w pamięci z powodu opóźnionej zerizacji.
Wykrywanie nieprawidłowych łańcuchów certyfikatów w python-cryptography może prowadzić do ataku DoS.
Wykorzystanie podatności w GitHub Enterprise Server pozwala na wstrzyknięcie złośliwych plików do repozytoriów.
Atakujący z odpowiednimi uprawnieniami może eskalować uprawnienia przez iControl SOAP.
Błąd w systemach BIG-IP pozwala na eskalację uprawnień przez uprzywilejowanego atakującego.
Modyfikacja obiektów konfiguracyjnych w iControl SOAP przez uwierzytelnionego atakującego prowadzi do eskalacji uprawnień.
In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to…
Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox config_denied_paths redaction to expose…
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user…
W JupyterLab błąd walidacji w pliku overrides.json pozwala na zdalne wykonanie kodu.
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,…
Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call…
Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH…
Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0.
openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the agent's normal tool authority to a remote caller.…
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without…
A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted ControlVault API call can lead to execute priviledged operation. An attacker can issue an api call…
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
@hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attackers can modify CloudTrail event selectors without complete detection, potentially evading audit trail monitoring.
A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
Błąd w Rancher Manager pozwala na eskalację uprawnień przez modyfikację ról.
Luka w Plate pozwala na osadzenie złośliwego iframe przez zaufanie do niezweryfikowanego źródła.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| A denial-of-service security issue exists in the affected product and version. | A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to its… |
Obserwuj | 8,7 | 0,25 % | ||
| Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input… | Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate… |
Obserwuj | 8,7 | 0,25 % | ||
| Błąd w Bouncy Castle dla Javy pozwala na ujawnienie kluczy w pamięci z powodu opóźnionej zerizacji. | Błąd w Bouncy Castle dla Javy pozwala na ujawnienie kluczy w pamięci z powodu opóźnionej zerizacji. |
Obserwuj | 8,7 | 0,25 % | ||
| Wykrywanie nieprawidłowych łańcuchów certyfikatów w python-cryptography może prowadzić do ataku DoS. | Wykrywanie nieprawidłowych łańcuchów certyfikatów w python-cryptography może prowadzić do ataku DoS. |
Obserwuj | 8,7 | 0,25 % | ||
| Wykorzystanie podatności w GitHub Enterprise Server pozwala na wstrzyknięcie złośliwych plików do repozytoriów. | Wykorzystanie podatności w GitHub Enterprise Server pozwala na wstrzyknięcie złośliwych plików do repozytoriów. |
Obserwuj | 8,6 | 0,75 % | ||
| Atakujący z odpowiednimi uprawnieniami może eskalować uprawnienia przez iControl SOAP. | Atakujący z odpowiednimi uprawnieniami może eskalować uprawnienia przez iControl SOAP. |
Obserwuj | 8,7 | 0,25 % | ||
| Błąd w systemach BIG-IP pozwala na eskalację uprawnień przez uprzywilejowanego atakującego. | Błąd w systemach BIG-IP pozwala na eskalację uprawnień przez uprzywilejowanego atakującego. |
Obserwuj | 8,7 | 0,25 % | ||
| Modyfikacja obiektów konfiguracyjnych w iControl SOAP przez uwierzytelnionego atakującego prowadzi do eskalacji uprawnień. | Modyfikacja obiektów konfiguracyjnych w iControl SOAP przez uwierzytelnionego atakującego prowadzi do eskalacji uprawnień. |
Obserwuj | 8,7 | 0,25 % | ||
| In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle.mls.protocol.Group… | In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to… |
Obserwuj | 8,7 | 0,25 % | ||
| Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by… | Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox config_denied_paths redaction to expose… |
Obserwuj | 8,7 | 0,25 % | ||
| Payload is a free and open source headless content management system. | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user… |
Obserwuj | 8,7 | 0,25 % | ||
| W JupyterLab błąd walidacji w pliku overrides.json pozwala na zdalne wykonanie kodu. | W JupyterLab błąd walidacji w pliku overrides.json pozwala na zdalne wykonanie kodu. |
Obserwuj | 8,6 | 0,75 % | ||
| Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that… | Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,… |
Obserwuj | 8,7 | 0,25 % | ||
| Plane is an open-source project management tool. | Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call… |
Obserwuj | 8,7 | 0,25 % | ||
| Plane is an open-source project management tool. | Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH… |
Obserwuj | 8,7 | 0,25 % | ||
| Plane is an open-source project management tool. | Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0. |
Obserwuj | 8,7 | 0,25 % | ||
| openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating… | openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the agent's normal tool authority to a remote caller.… |
Obserwuj | 8,7 | 0,25 % | ||
| A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows… | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message. |
Obserwuj | 8,7 | 0,25 % | ||
| TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An… | TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without… |
Obserwuj | 8,7 | 0,25 % | ||
| A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and… | A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted ControlVault API call can lead to execute priviledged operation. An attacker can issue an api call… |
Obserwuj | 8,7 | 0,25 % | ||
| A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution. | A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution. |
Obserwuj | 8,6 | 0,74 % | ||
| @hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration… | @hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attackers can modify CloudTrail event selectors without complete detection, potentially evading audit trail monitoring. |
Obserwuj | 8,7 | 0,24 % | ||
| A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release… | A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session. |
Obserwuj | 8,7 | 0,24 % | ||
| Błąd w Rancher Manager pozwala na eskalację uprawnień przez modyfikację ról. | Błąd w Rancher Manager pozwala na eskalację uprawnień przez modyfikację ról. |
Obserwuj | 8,7 | 0,24 % | ||
| Luka w Plate pozwala na osadzenie złośliwego iframe przez zaufanie do niezweryfikowanego źródła. | Luka w Plate pozwala na osadzenie złośliwego iframe przez zaufanie do niezweryfikowanego źródła. |
Obserwuj | 8,7 | 0,24 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.