Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
In affected TP-Link Aginet devices, insufficient
authorization validation allows authenticated low-privileged users to execute higher-privileged
operations.
An attacker
may perform administrative actions such as creating privileged accounts or
modifying critical configuration settings.
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, config.go initializes Security.Enabled to false, and when MCP_SHELL_SEC_CONFIG_FILE is unset, main.go starts the documented bare-binary deployment without a security policy.…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2…
Opis źródłowy NVD · ENCVSS 8,2 · EPSS 2,19 % · rekomendacja wg zapisanej polityki
siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors access to secure memories, access to crypto operations, and the ability to turn on and off subsystems within the SOC.
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and gain administrator-level access to…
Opis źródłowy NVD · ENCVSS 8,1 · EPSS 2,68 % · rekomendacja wg zapisanej polityki
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accepted the bare` Transfer-Encoding:`…
Opis źródłowy NVD · ENCVSS 7,7 · EPSS 4,68 % · rekomendacja wg zapisanej polityki
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
CVSS
8,6
EPSS
0,17 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
In affected TP-Link Aginet devices, insufficient
authorization validation allows authenticated low-privileged users to execute higher-privileged
operations.
An attacker
may perform administrative actions such as creating privileged accounts or
modifying critical configuration settings.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, config.go initializes Security.Enabled to false, and when MCP_SHELL_SEC_CONFIG_FILE is unset, main.go starts the documented bare-binary deployment without a security policy.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,2 · EPSS 2,19 % · rekomendacja wg zapisanej polityki
siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors access to secure memories, access to crypto operations, and the ability to turn on and off subsystems within the SOC.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and gain administrator-level access to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,1 · EPSS 2,68 % · rekomendacja wg zapisanej polityki
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accepted the bare` Transfer-Encoding:`…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,7 · EPSS 4,68 % · rekomendacja wg zapisanej polityki
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
8,6
0,17 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.