KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by…
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for…
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called…
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers…
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a…
A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of…
The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for…
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself,…
A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined…
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two…
A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow.
HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.
HPE NonStop MODULAR NSJ contains a predictable seed vulnerability in Random Number Generation (PRNG)
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not…
A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow.
A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.
A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN…
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the…
A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane (such as emoji) to an ASF container, the plugin incorrectly calculates…
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details…
A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown.
The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (profile.php) + comment (wp-comments-post.php)' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-101338 When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker… |
Monitoruj |
CVSS 8,7EPSS 0,32 % | ||
| CVE-2026-101339 A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker… |
Monitoruj |
CVSS 8,7EPSS 0,32 % | ||
| CVE-2026-101341 Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes,… |
Monitoruj |
CVSS 8,7EPSS 0,34 % | ||
| CVE-2026-103308 The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which… |
Pozostałe |
CVSS 6,5EPSS 0,14 % | ||
| CVE-2026-103358 Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This… |
Monitoruj |
CVSS 7,5EPSS 0,32 % | ||
| CVE-2026-100229 A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is… |
Pozostałe |
CVSS 6,5EPSS 0,3 % | ||
| CVE-2026-101301 The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors… |
Pozostałe |
CVSS 5,3EPSS 0,26 % | ||
| CVE-2026-101337 When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of… |
Monitoruj |
CVSS 8,7EPSS 0,32 % | ||
| CVE-2026-88829 A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP… |
Monitoruj |
CVSS 7,2EPSS 0,32 % | ||
| CVE-2026-90954 A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush… |
Monitoruj |
CVSS 7,8EPSS 0,2 % | ||
| CVE-2026-73792 A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow. |
Pozostałe |
CVSS 3,8EPSS 0,31 % | ||
| CVE-2026-73793 HPE NonStop Middleware software has secret key handling and data deserialization vulnerability. |
Monitoruj |
CVSS 7,9EPSS 0,36 % | ||
| CVE-2026-73794 HPE NonStop MODULAR NSJ contains a predictable seed vulnerability in Random Number Generation (PRNG) |
Pozostałe |
CVSS 4,6EPSS 0,18 % | ||
| CVE-2026-86476 A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that… |
Monitoruj |
CVSS 8,4EPSS 0,19 % | ||
| CVE-2026-73791 A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow. |
Pozostałe |
CVSS 2,0EPSS 0,19 % | ||
| CVE-2026-109971 A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user… |
Pozostałe |
CVSS 4,7EPSS 0,15 % | ||
| CVE-2026-109970 A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the… |
Pozostałe |
CVSS 4,7EPSS 0,12 % | ||
| CVE-2026-109969 A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification.… |
Pozostałe |
CVSS 4,7EPSS 0,13 % | ||
| CVE-2026-100231 A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane… |
Pozostałe |
CVSS 6,1EPSS 0,14 % | ||
| CVE-2026-103671 External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary… |
Pozostałe |
CVSS 5,3EPSS 0,22 % | ||
| CVE-2026-107428 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected… |
Monitoruj |
CVSS 7,1EPSS 0,19 % | ||
| CVE-2026-14851 A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data –… |
Wysoki priorytet |
CVSS 9,2EPSS 0,33 % | ||
| CVE-2026-73790 A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown. |
Monitoruj |
CVSS 8,2EPSS 0,31 % | ||
| CVE-2026-107757 The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (profile.php) + comment (wp-comments-post.php)' parameter in all versions… |
Pozostałe |
CVSS 4,9EPSS 0,24 % | ||
| CVE-2026-109901 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL… |
Monitoruj |
CVSS 8,5EPSS 0,28 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 10.11.2026, 11:32 UTC – 10.11.2026, 13:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.