Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Passy | CVE-2026-112105 A vulnerability has been found in GlitterWare Passy up to 1.10.1. The affected element is the function MyHttpOverrides in the library lib/main.dart of the component TLS Handler. Such manipulation leads to improper certificate validation. The attack may be launched remotely. This attack is… |
6,3 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| TikTok-Video-Downloader-PHP | CVE-2026-112106 A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d. Affected by this issue is some unknown functionality of the file index.php of the component TLS Handler. Such manipulation leads to improper certificate validation.… |
6,3 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| fatfree-core | CVE-2026-112103 A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are… |
6,3 | 0,38 % | Brak wpisu w KEV nie wyklucza ataków | |
| bandcamp-player | CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched… |
6,9 | 0,63 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-79613 vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could access comments associated with non-public content through public user profiles. Users are recommended to upgrade to version 2.0.3, which fixes the issue. |
5,3 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-79620 Exposure of sensitive information through data queries vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions. Users are… |
4,3 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-79624 Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version… |
9,8 | 0,39 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-79633 vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Missing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access. Users are recommended to upgrade to version 2.0.3, which fixes the issue. |
8,1 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-86589 Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to… |
5,4 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-90910 Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their… |
9,8 | 0,48 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-64943 Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer… |
8,1 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-64944 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization… |
5,4 | 0,18 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-64945 A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these… |
7,5 | 0,3 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-67249 A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3,… |
5,4 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-68482 Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to… |
5,3 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-71563 Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions. Users are… |
4,3 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-76994 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles. Users are recommended to upgrade to… |
7,5 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| MISP | CVE-2026-112184 MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names… |
4,8 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| MISP | CVE-2026-112188 MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name… |
7,1 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| MISP | CVE-2026-112192 MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata. As a result: - A module that marks a setting (such as… |
5,3 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| MapSVG | CVE-2026-111406 Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1. |
9,9 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| Tutor LMS | CVE-2026-111407 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2. |
6,5 | 0,16 % | Brak wpisu w KEV nie wyklucza ataków | |
| Quiz And Survey Master | CVE-2026-111408 Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7. |
8,8 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| DeepPavlov | CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ of the file deeppavlov/models/preprocessors/multitask_preprocessor.py. This manipulation of the argument preprocessor causes code injection. The attack is possible to be… |
2,0 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| pi-agent-dashboard | CVE-2026-112101 A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation… |
2,1 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 23:02 UTC – 14.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.