Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Apache Answer | CVE-2026-79620 Exposure of sensitive information through data queries vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions. Users are… |
4,3 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-79624 Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version… |
9,8 | 0,39 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-79633 vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Missing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access. Users are recommended to upgrade to version 2.0.3, which fixes the issue. |
8,1 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-86589 Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to… |
5,4 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-90910 Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their… |
9,8 | 0,48 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-64943 Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer… |
8,1 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-64944 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization… |
5,4 | 0,18 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-64945 A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these… |
7,5 | 0,3 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-67249 A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3,… |
5,4 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-68482 Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to… |
5,3 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-71563 Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions. Users are… |
4,3 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Answer | CVE-2026-76994 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles. Users are recommended to upgrade to… |
7,5 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| MISP | CVE-2026-112184 MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names… |
4,8 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| MISP | CVE-2026-112188 MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name… |
7,1 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| MISP | CVE-2026-112192 MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata. As a result: - A module that marks a setting (such as… |
5,3 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| MapSVG | CVE-2026-111406 Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1. |
9,9 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| Tutor LMS | CVE-2026-111407 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2. |
6,5 | 0,16 % | Brak wpisu w KEV nie wyklucza ataków | |
| Quiz And Survey Master | CVE-2026-111408 Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7. |
8,8 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| DeepPavlov | CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ of the file deeppavlov/models/preprocessors/multitask_preprocessor.py. This manipulation of the argument preprocessor causes code injection. The attack is possible to be… |
2,0 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| pi-agent-dashboard | CVE-2026-112101 A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation… |
2,1 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| NLP.js | CVE-2026-112102 A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch… |
2,1 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| MISP | CVE-2026-112183 MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity… |
4,8 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Kylin | CVE-2026-108823 Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version… |
7,5 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Kylin | CVE-2026-108833 Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. |
7,5 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache Kylin | CVE-2026-108837 Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to… |
7,5 | 0,4 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 14.11.2026, 03:02 UTC – 14.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.