Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied read can submit search queries or node IDs…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://github.com/aws-solutions-library-samples/qnabot-on-aws/blob/main/source/docs/lambda_hooks/README.md ), available with QnABot on AWS versions 7.0.0 through 7.4.5,…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown.
The cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger than the configured…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set item_number, cart_order_id, or the PayPal custom field…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An authenticated user with Viewer privileges could submit crafted search input that causes excessive processing, potentially degrading the availability of the application.
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys_log table,…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries.
This issue has been addressed in…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Block2 response when _block_cb() sees…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the URL…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited information from process memory.
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files.
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/{entry_id}…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
CVSS
7,1
EPSS
0,26 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied read can submit search queries or node IDs…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://github.com/aws-solutions-library-samples/qnabot-on-aws/blob/main/source/docs/lambda_hooks/README.md ), available with QnABot on AWS versions 7.0.0 through 7.4.5,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown.
The cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger than the configured…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set item_number, cart_order_id, or the PayPal custom field…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An authenticated user with Viewer privileges could submit crafted search input that causes excessive processing, potentially degrading the availability of the application.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys_log table,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries.
This issue has been addressed in…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Block2 response when _block_cb() sees…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the URL…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited information from process memory.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/{entry_id}…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
7,1
0,26 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.