Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 1,14 % · rekomendacja wg zapisanej polityki
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 2,13 % · rekomendacja wg zapisanej polityki
In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later.
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. Attackers can…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 1,12 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
inetpeer: randomize RB-tree node comparison using SipHash
The inetpeer rate limiting system stores peer entries in a Red-Black tree
keyed deterministically on the remote IP address. Because tree lookups walk
the RB-tree using…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skill_upload in packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py takes file.filename as given and writes the request body to upload_dir /…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 1,11 % · rekomendacja wg zapisanej polityki
AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by submitting crafted queries to the unprotected POST /query API endpoint bound to 0.0.0.0:7777 with wildcard CORS. Attackers can…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 1,1 % · rekomendacja wg zapisanej polityki
A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 1,1 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument Hostname leads to stack-based buffer overflow. It is possible…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 1,1 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
cifs: validate DFS referral string offsets
parse_dfs_referrals() validates that the response header and referral
array fit in the received buffer, but each referral also contains string
offsets supplied by the server.
Those…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
CVSS
9,4
EPSS
0,59 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 1,14 % · rekomendacja wg zapisanej polityki
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 2,13 % · rekomendacja wg zapisanej polityki
In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. Attackers can…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 1,12 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
inetpeer: randomize RB-tree node comparison using SipHash
The inetpeer rate limiting system stores peer entries in a Red-Black tree
keyed deterministically on the remote IP address. Because tree lookups walk
the RB-tree using…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skill_upload in packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py takes file.filename as given and writes the request body to upload_dir /…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 1,11 % · rekomendacja wg zapisanej polityki
AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by submitting crafted queries to the unprotected POST /query API endpoint bound to 0.0.0.0:7777 with wildcard CORS. Attackers can…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 1,1 % · rekomendacja wg zapisanej polityki
A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 1,1 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument Hostname leads to stack-based buffer overflow. It is possible…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 1,1 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
cifs: validate DFS referral string offsets
parse_dfs_referrals() validates that the response header and referral
array fit in the received buffer, but each referral also contains string
offsets supplied by the server.
Those…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
9,4
0,59 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.