Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange…
Opis źródłowy NVD · ENCVSS 8,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Communications Panel/Dashboard). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.…
Opis źródłowy NVD · ENCVSS 8,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional authenticated data arrays with JNI's ReleaseByteArrayElements in mode 0, which commits the native copy back into the Java array.…
Opis źródłowy NVD · ENCVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in…
Opis źródłowy NVD · ENCVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
CVE-2026-97714
is a is a vulnerability in the authentication sub-system of Secure Access
servers prior to version 14.60. Attackers can send a malformed response during
authentication and cause a persistent denial of service.
Opis źródłowy NVD · ENCVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed…
Opis źródłowy NVD · ENCVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and…
Opis źródłowy NVD · ENCVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion.
Opis źródłowy NVD · ENCVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · ENCVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by…
Opis źródłowy NVD · ENCVSS 8,1 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute…
Opis źródłowy NVD · ENCVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be called without authentication, and they trust a…
Opis źródłowy NVD · ENCVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
CVSS
8,2
EPSS
0,25 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Communications Panel/Dashboard). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional authenticated data arrays with JNI's ReleaseByteArrayElements in mode 0, which commits the native copy back into the Java array.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
CVE-2026-97714
is a is a vulnerability in the authentication sub-system of Secure Access
servers prior to version 14.60. Attackers can send a malformed response during
authentication and cause a persistent denial of service.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,1 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be called without authentication, and they trust a…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
8,2
0,25 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.