Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
A parameter taken from the request body is inserted into
a T-SQL statement without parameterization or escaping, allowing
a remote attacker to execute arbitrary SQL statements in the context of the
application's database account.
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,47 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
riscv: lib: Fix ZBB strnlen reading past count boundary
The ZBB-optimized strnlen loop loads one word ahead before checking the
aligned boundary:
REG_L t1, SZREG(t0) // load next word
addi t0, t0, SZREG…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_service in file /usr/lib/lua/luci/controller/admin/service.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 3,46 % · rekomendacja wg zapisanej polityki
Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the Legacy Remoting Service that is enabled by default. The service registers a TCP remoting channel…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,96 % · rekomendacja wg zapisanej polityki
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
A parameter taken from the request body is inserted into
a T-SQL statement without parameterization or escaping, allowing
a remote attacker to execute arbitrary SQL statements in the context of the
application's database account.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,47 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
riscv: lib: Fix ZBB strnlen reading past count boundary
The ZBB-optimized strnlen loop loads one word ahead before checking the
aligned boundary:
REG_L t1, SZREG(t0) // load next word
addi t0, t0, SZREG…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_service in file /usr/lib/lua/luci/controller/admin/service.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 3,46 % · rekomendacja wg zapisanej polityki
Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the Legacy Remoting Service that is enabled by default. The service registers a TCP remoting channel…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,96 % · rekomendacja wg zapisanej polityki
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,45 % · rekomendacja wg zapisanej polityki