KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew…
The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and…
XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output.…
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator.
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the…
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options…
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data…
Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser…
virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and…
A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the…
A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen.
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one…
Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in…
Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to…
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to…
ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a…
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains…
ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image…
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-112380 Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent… |
Wysoki priorytet |
CVSS 9,0EPSS 0,41 % | ||
| CVE-2026-107692 The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption.… |
Pozostałe |
CVSS 4,8EPSS 0,14 % | ||
| CVE-2026-97406 XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent… |
Wysoki priorytet |
CVSS 9,1EPSS 0,53 % | ||
| CVE-2026-113714 virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads directly into the reusable wheel/house cache… |
Pozostałe |
CVSS 2,3EPSS 0,25 % | ||
| CVE-2026-113808 A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS… |
Monitoruj |
CVSS 7,1EPSS 0,21 % | ||
| CVE-2026-113810 A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user.… |
Monitoruj |
CVSS 7,0EPSS 0,1 % | ||
| CVE-2026-113708 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote… |
Wysoki priorytet |
CVSS 9,9EPSS 0,67 % | ||
| CVE-2026-113709 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize… |
Wysoki priorytet |
CVSS 9,9EPSS 0,53 % | ||
| CVE-2026-113712 Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form, allowing an authenticated… |
Pozostałe |
CVSS 4,8EPSS 0,46 % | ||
| CVE-2026-113713 virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that… |
Pozostałe |
CVSS 4,4EPSS 0,2 % | ||
| CVE-2026-113643 A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the… |
Pozostałe |
CVSS 4,3EPSS 0,38 % | ||
| CVE-2026-111088 A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen. |
Pozostałe |
CVSS 6,5EPSS 0,22 % | ||
| CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore)… |
Monitoruj |
CVSS 8,6EPSS 0,35 % | ||
| CVE-2026-100132 Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive… |
Pozostałe |
CVSS 4,3EPSS 0,44 % | ||
| CVE-2026-100134 Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires… |
Monitoruj |
CVSS 8,8EPSS 0,79 % | ||
| CVE-2026-113710 ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login… |
Pozostałe |
CVSS 5,9EPSS 0,33 % | ||
| CVE-2026-113711 ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without… |
Monitoruj |
CVSS 7,5EPSS 0,53 % | ||
| CVE-2026-113802 Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id… |
Wysoki priorytet |
CVSS 9,3EPSS 3,47 % | ||
| CVE-2026-113666 ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection… |
Monitoruj |
CVSS 7,1EPSS 0,44 % | ||
| CVE-2026-113667 ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA… |
Pozostałe |
CVSS 5,3EPSS 0,37 % | ||
| CVE-2026-113668 ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the… |
Pozostałe |
CVSS 5,3EPSS 0,32 % | ||
| CVE-2026-113669 ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a… |
Pozostałe |
CVSS 5,3EPSS 0,42 % | ||
| CVE-2026-113671 ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a… |
Pozostałe |
CVSS 4,3EPSS 0,33 % | ||
| CVE-2026-113672 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer… |
Wysoki priorytet |
CVSS 9,9EPSS 0,84 % | ||
| CVE-2026-113659 ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by… |
Pozostałe |
CVSS 6,1EPSS 0,35 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 15:02 UTC – 12.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.