Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload,…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into execute_command arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badge_number' parameter as the HMAC private key, the value of which remains static and is accessible via the API…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated requests that are…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person,…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browser_download writes a fetched response body to join(save_dir, filename) without validating the caller-controlled save_dir, while browser_save_state and browser_load_state honor a…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State.
This issue affects Biletiva Ticketing Platform: through 2026-07-23.
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
CVSS
8,6
EPSS
0,22 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into execute_command arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badge_number' parameter as the HMAC private key, the value of which remains static and is accessible via the API…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated requests that are…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browser_download writes a fetched response body to join(save_dir, filename) without validating the caller-controlled save_dir, while browser_save_state and browser_load_state honor a…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State.
This issue affects Biletiva Ticketing Platform: through 2026-07-23.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
8,6
0,22 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.