KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured…
A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply…
A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, including a control block…
The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array. One of the two unproved…
A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near the top of a…
One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a `TX_THREAD` control block through `txm_module_object_allocate`; `_txm_module_manager_thread_create` then takes a…
The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation…
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is…
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`,…
The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets…
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus…
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.
A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for *using* an object, and using…
The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the…
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is…
`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The over-read can also cause callers to advance their index past the end of the string,…
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes…
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to…
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a…
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username…
VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-113651 ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local… |
Pozostałe |
CVSS 3,3EPSS 0,33 % | ||
| CVE-2026-113505 A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the… |
Pozostałe |
CVSS 2,1EPSS 0,48 % | ||
| CVE-2026-112957 ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission… |
Pozostałe |
CVSS 4,3EPSS 0,31 % | ||
| CVE-2026-112958 ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style… |
Pozostałe |
CVSS 5,4EPSS 0,3 % | ||
| CVE-2026-94192 A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`.… |
Monitoruj |
CVSS 8,5EPSS 0,15 % | ||
| CVE-2026-94202 The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then… |
Pozostałe |
CVSS 4,8EPSS 0,15 % | ||
| CVE-2026-95107 A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the… |
Monitoruj |
CVSS 7,0EPSS 0,15 % | ||
| CVE-2026-95108 One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a `TX_THREAD` control block through… |
Pozostałe |
CVSS 6,8EPSS 0,17 % | ||
| CVE-2026-95109 The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the… |
Monitoruj |
CVSS 8,5EPSS 0,15 % | ||
| CVE-2026-92843 A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds… |
Monitoruj |
CVSS 8,7EPSS 0,3 % | ||
| CVE-2026-92853 The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length… |
Monitoruj |
CVSS 8,7EPSS 0,3 % | ||
| CVE-2026-93003 The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is… |
Pozostałe |
CVSS 6,9EPSS 0,33 % | ||
| CVE-2026-93475 The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the… |
Wysoki priorytet |
CVSS 9,3EPSS 0,25 % | ||
| CVE-2026-94018 The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by… |
Monitoruj |
CVSS 8,8EPSS 0,4 % | ||
| CVE-2026-94023 A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's… |
Pozostałe |
CVSS 6,9EPSS 0,13 % | ||
| CVE-2026-94024 The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's… |
Pozostałe |
CVSS 6,9EPSS 0,14 % | ||
| CVE-2026-90800 Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an… |
Monitoruj |
CVSS 8,1EPSS 0,63 % | ||
| CVE-2026-91057 `_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The over-read can… |
Pozostałe |
CVSS 4,6EPSS 0,16 % | ||
| CVE-2026-86471 An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system… |
Wysoki priorytet |
CVSS 9,3EPSS 0,61 % | ||
| CVE-2026-90797 An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are… |
Monitoruj |
CVSS 7,7EPSS 0,67 % | ||
| CVE-2026-90798 A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating… |
Pozostałe |
CVSS 0,6EPSS 0,6 % | ||
| CVE-2026-90799 Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are… |
Pozostałe |
CVSS 1,3EPSS 0,64 % | ||
| CVE-2026-113681 OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap… |
Pozostałe |
CVSS 6,8EPSS 0,17 % | ||
| CVE-2026-113682 Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users.… |
Wysoki priorytet |
CVSS 9,1EPSS 0,56 % | ||
| CVE-2026-113683 VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded… |
Pozostałe |
CVSS 5,1EPSS 0,36 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 23:02 UTC – 13.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.