KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0.
Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7.
Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat…
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.
Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account…
A security vulnerability in HPE NonStop TSQLFIL may cause address space corruption when a specific API is called.
A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service.
The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary…
The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and…
A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be…
The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The…
A security vulnerability in HPE NonStop TMF Auditread2 can cause Denial of Service.
A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query.
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow…
Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on…
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.
A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before…
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the…
The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. **fork()s** a child process 2. **setns()** into the target container's…
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-107422 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue… |
Pozostałe |
CVSS 6,5EPSS 0,18 % | ||
| CVE-2026-107424 Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through… |
Wysoki priorytet |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2026-107425 Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access… |
Pozostałe |
CVSS 6,5EPSS 0,27 % | ||
| CVE-2026-107426 Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
Monitoruj |
CVSS 7,3EPSS 0,27 % | ||
| CVE-2026-107433 Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP… |
Pozostałe |
CVSS 6,5EPSS 0,27 % | ||
| CVE-2026-105874 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart:… |
Monitoruj |
CVSS 7,1EPSS 0,2 % | ||
| CVE-2026-106599 Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3. |
Monitoruj |
CVSS 8,8EPSS 0,42 % | ||
| CVE-2026-76655 A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution |
Monitoruj |
CVSS 7,5EPSS 0,57 % | ||
| CVE-2026-85298 An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an… |
Monitoruj |
CVSS 7,3EPSS 0,36 % | ||
| CVE-2026-73797 A security vulnerability in HPE NonStop TSQLFIL may cause address space corruption when a specific API is called. |
Pozostałe |
CVSS 5,3EPSS 0,11 % | ||
| CVE-2026-73798 A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service. |
Monitoruj |
CVSS 8,2EPSS 0,33 % | ||
| CVE-2026-97315 The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to… |
Pozostałe |
CVSS 5,4EPSS 0,23 % | ||
| CVE-2026-88998 The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount,… |
Pozostałe |
CVSS 5,3EPSS 0,15 % | ||
| CVE-2026-88842 A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first… |
Pozostałe |
CVSS 3,3EPSS 0,17 % | ||
| CVE-2026-82844 The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing… |
Pozostałe |
CVSS 5,3EPSS 0,14 % | ||
| CVE-2026-73795 A security vulnerability in HPE NonStop TMF Auditread2 can cause Denial of Service. |
Pozostałe |
CVSS 6,4EPSS 0,11 % | ||
| CVE-2026-73796 A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query. |
Pozostałe |
CVSS 4,4EPSS 0,13 % | ||
| CVE-2026-108071 Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could… |
Monitoruj |
CVSS 8,7EPSS 0,47 % | ||
| CVE-2026-108072 Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient… |
Pozostałe |
CVSS 5,4EPSS 0,13 % | ||
| CVE-2026-107431 Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder:… |
Monitoruj |
CVSS 7,5EPSS 0,33 % | ||
| CVE-2026-108070 A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by… |
Monitoruj |
CVSS 8,7EPSS 0,45 % | ||
| CVE-2026-105067 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL… |
Monitoruj |
CVSS 8,5EPSS 0,28 % | ||
| CVE-2026-103905 The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user… |
Monitoruj |
CVSS 8,7EPSS 0,53 % | ||
| CVE-2026-104795 The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1.… |
Monitoruj |
CVSS 8,8EPSS 0,18 % | ||
| CVE-2026-103904 The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored… |
Monitoruj |
CVSS 8,6EPSS 0,4 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 10.11.2026, 11:32 UTC – 10.11.2026, 13:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.