KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code parameter and passes it to `adb shell input keyevent`. The adb client joins the…
The AMMOS Instrument Toolkit (Formerly the Bespoke Links to Instruments for Surface and Space (BLISS)) is a Python-based software suite developed to handle Ground Data System (GDS), Electronic Ground Support Equipment (EGSE), commanding, telemetry uplink/downlink, and sequencing for instrument and…
Nieprawidłowa kontrola dostępu w Azure SQL Database umożliwia eskalację uprawnień przez sieć.
Wstrzyknięcie formatu w Ruby JSON może prowadzić do ataków typu denial of service lub ujawnienia informacji przy użyciu opcji allow_duplicate_key:…
Brak uwierzytelnienia w początkowej konfiguracji GBIF IPT umożliwia zdalne przejęcie kontroli.
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted…
Wstrzyknięcie pakietów UDP w MOOS umożliwia atakującym wstrzykiwanie zmiennych do społeczności MOOS.
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email…
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server…
Przepełnienie bufora w OpenSIPS umożliwia zdalne wykonanie kodu przez atakującego.
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes…
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised…
Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validating…
Luka przepełnienia ścieżki w Apache FreeMarker umożliwia dostęp do nieautoryzowanych plików.
Brak uwierzytelnienia w Azure MCP Server umożliwia nieautoryzowanemu atakującemu ujawnienie informacji.
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
Zdalne wykonanie kodu w CTX Feed umożliwia atakującym przejęcie kontroli nad systemem.
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four…
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3…
In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was received isert_login_recv_done() records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU's BHS…
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and login->req_buf is allocated…
A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.
Wielokrotne luki w walidacji wejścia w Snowflake Spark Connector umożliwiają kradzież poświadczeń OAuth i wykonanie dowolnego SQL.
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. | Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code parameter and passes it to `adb shell input keyevent`. The adb client joins the… |
W tym tygodniu | 9,1 | 0,87 % | ||
| The AMMOS Instrument Toolkit (Formerly the Bespoke Links to Instruments for Surface and Space (BLISS)) is a Python-based software suite… | The AMMOS Instrument Toolkit (Formerly the Bespoke Links to Instruments for Surface and Space (BLISS)) is a Python-based software suite developed to handle Ground Data System (GDS), Electronic Ground Support Equipment (EGSE), commanding, telemetry uplink/downlink, and sequencing for instrument and… |
W tym tygodniu | 9,1 | 0,86 % | ||
| Nieprawidłowa kontrola dostępu w Azure SQL Database umożliwia eskalację uprawnień przez sieć. | Nieprawidłowa kontrola dostępu w Azure SQL Database umożliwia eskalację uprawnień przez sieć. |
W tym tygodniu | 9,1 | 0,86 % | ||
| Wstrzyknięcie formatu w Ruby JSON może prowadzić do ataków typu denial of service lub ujawnienia informacji przy użyciu opcji… | Wstrzyknięcie formatu w Ruby JSON może prowadzić do ataków typu denial of service lub ujawnienia informacji przy użyciu opcji allow_duplicate_key:… |
W tym tygodniu | 9,1 | 0,86 % | ||
| Brak uwierzytelnienia w początkowej konfiguracji GBIF IPT umożliwia zdalne przejęcie kontroli. | Brak uwierzytelnienia w początkowej konfiguracji GBIF IPT umożliwia zdalne przejęcie kontroli. |
W tym tygodniu | 9,1 | 0,86 % | ||
| Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google… | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted… |
W tym tygodniu | 9,2 | 0,35 % | ||
| Wstrzyknięcie pakietów UDP w MOOS umożliwia atakującym wstrzykiwanie zmiennych do społeczności MOOS. | Wstrzyknięcie pakietów UDP w MOOS umożliwia atakującym wstrzykiwanie zmiennych do społeczności MOOS. |
W tym tygodniu | 8,7 | 2,84 % | ||
| A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism. | A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism. |
W tym tygodniu | 9,2 | 0,34 % | ||
| Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request,… | Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email… |
W tym tygodniu | 9,2 | 0,34 % | ||
| The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly… | The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server… |
W tym tygodniu | 9,2 | 0,34 % | ||
| Przepełnienie bufora w OpenSIPS umożliwia zdalne wykonanie kodu przez atakującego. | Przepełnienie bufora w OpenSIPS umożliwia zdalne wykonanie kodu przez atakującego. |
W tym tygodniu | 9,1 | 0,83 % | ||
| ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over… | ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes… |
W tym tygodniu | 9,2 | 0,33 % | ||
| A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally… | A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised… |
W tym tygodniu | 9,2 | 0,33 % | ||
| Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. | Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validating… |
W tym tygodniu | 9,2 | 0,33 % | ||
| Luka przepełnienia ścieżki w Apache FreeMarker umożliwia dostęp do nieautoryzowanych plików. | Luka przepełnienia ścieżki w Apache FreeMarker umożliwia dostęp do nieautoryzowanych plików. |
W tym tygodniu | 9,1 | 0,83 % | ||
| Brak uwierzytelnienia w Azure MCP Server umożliwia nieautoryzowanemu atakującemu ujawnienie informacji. | Brak uwierzytelnienia w Azure MCP Server umożliwia nieautoryzowanemu atakującemu ujawnienie informacji. |
W tym tygodniu | 9,1 | 0,83 % | ||
| Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass… | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. |
W tym tygodniu | 9,1 | 0,83 % | ||
| Zdalne wykonanie kodu w CTX Feed umożliwia atakującym przejęcie kontroli nad systemem. | Zdalne wykonanie kodu w CTX Feed umożliwia atakującym przejęcie kontroli nad systemem. |
W tym tygodniu | 9,1 | 0,82 % | ||
| Pillow is a Python imaging library. | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four… |
W tym tygodniu | 9,2 | 0,32 % | ||
| Pillow is a Python imaging library. | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3… |
W tym tygodniu | 9,2 | 0,32 % | ||
| In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was… | In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was received isert_login_recv_done() records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU's BHS… |
W tym tygodniu | 9,1 | 0,82 % | ||
| In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login… | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and login->req_buf is allocated… |
W tym tygodniu | 9,1 | 0,82 % | ||
| A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution. | A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution. |
W tym tygodniu | 9,2 | 0,31 % | ||
| Wielokrotne luki w walidacji wejścia w Snowflake Spark Connector umożliwiają kradzież poświadczeń OAuth i wykonanie dowolnego SQL. | Wielokrotne luki w walidacji wejścia w Snowflake Spark Connector umożliwiają kradzież poświadczeń OAuth i wykonanie dowolnego SQL. |
W tym tygodniu | 9,2 | 0,31 % | ||
| Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to… |
W tym tygodniu | 9,1 | 0,81 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.