Podatności

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or…

CVSS 7,6 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1.

CVSS 7,6 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.

CVSS 7,6 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1.

CVSS 7,6 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and…

CVSS 7,6 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field

CVSS 7,6 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable…

CVSS 7,6 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.

CVSS 7,5 · EPSS 0,69 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.

CVSS 7,5 · EPSS 0,69 % · rekomendacja wg zapisanej polityki

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing…

CVSS 7,5 · EPSS 0,69 % · rekomendacja wg zapisanej polityki

A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.

CVSS 7,5 · EPSS 0,66 % · rekomendacja wg zapisanej polityki

Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network.

CVSS 7,5 · EPSS 0,66 % · rekomendacja wg zapisanej polityki

Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network.

CVSS 7,5 · EPSS 0,66 % · rekomendacja wg zapisanej polityki

NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure.

CVSS 7,5 · EPSS 0,66 % · rekomendacja wg zapisanej polityki

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a…

CVSS 7,6 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue…

CVSS 7,5 · EPSS 0,64 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue…

CVSS 7,5 · EPSS 0,64 % · rekomendacja wg zapisanej polityki

IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

CVSS 7,5 · EPSS 0,62 % · rekomendacja wg zapisanej polityki

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a…

CVSS 7,5 · EPSS 0,62 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user…

CVSS 7,5 · EPSS 0,61 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user…

CVSS 7,5 · EPSS 0,61 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user…

CVSS 7,5 · EPSS 0,61 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user…

CVSS 7,5 · EPSS 0,61 % · rekomendacja wg zapisanej polityki

Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.

CVSS 7,5 · EPSS 0,61 % · rekomendacja wg zapisanej polityki

Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

CVSS 7,5 · EPSS 0,6 % · rekomendacja wg zapisanej polityki