Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| SGLang | CVE-2026-112082 A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is… |
7,7 | 0,63 % | Brak wpisu w KEV nie wyklucza ataków | |
| SGLang | CVE-2026-112083 A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the component Weight Exporter. Performing a manipulation of the… |
5,5 | 0,42 % | Brak wpisu w KEV nie wyklucza ataków | |
| ESPnet | CVE-2026-112086 A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model Handler. The manipulation of the argument _target_ results in deserialization. It is possible to launch the attack… |
2,1 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| SME Server | CVE-2026-108121 Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from… |
6,9 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| HanLP | CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate… |
2,1 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| SME Server | CVE-2026-108120 Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside… |
7,7 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| ActiveTrail for WooCommerce | CVE-2026-106028 The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons. |
5,3 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| Blaze Demo Importer | CVE-2026-106933 The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the… |
6,8 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| Gateway for Vantiv on WC | CVE-2026-106014 The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying. |
5,3 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| radare2 | CVE-2026-112077 A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_core_cmd_str_pipe in the library libr/core/rtr_http.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the… |
6,3 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| Retrieval-based-Voice-Conversion-WebUI | CVE-2026-112078 A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py. Executing a manipulation of the argument ckpt_path can lead to code injection. The attack can be executed remotely. The exploit has been… |
2,1 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| HanLP | CVE-2026-112079 A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely.… |
2,1 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| Llama-Chinese | CVE-2026-112080 A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b. The impacted element is the function get_class_from_dynamic_module of the file examples/chat_gradio_no_merge.py of the component Adapter Config. The manipulation of the argument… |
2,1 | 0,39 % | Brak wpisu w KEV nie wyklucza ataków | |
| unsloth | CVE-2026-112075 A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select… |
2,1 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| MeTube | CVE-2026-112076 A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.__write_feed_metadata_sync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery.… |
2,9 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| donetick | CVE-2026-112045 A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be… |
2,1 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| ncnn | CVE-2026-112073 A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul_transb of the file src/layer/matmul.cpp of the component MatMul. The manipulation leads to out-of-bounds read. The attack can be initiated remotely.… |
2,1 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| ncnn | CVE-2026-112074 A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched… |
2,1 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| openGauss-connector-jdbc | CVE-2026-111440 在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath… |
7,0 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| eShop | CVE-2026-112044 A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file src/Catalog.API/Extensions/Extensions.cs of the component Catalog API. The manipulation leads to improper… |
5,5 | 0,4 % | Brak wpisu w KEV nie wyklucza ataków | |
| SAM | CVE-2026-102503 Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to… |
9,3 | 0,43 % | Brak wpisu w KEV nie wyklucza ataków | |
| SAM | CVE-2026-103091 Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions… |
9,3 | 0,64 % | Brak wpisu w KEV nie wyklucza ataków | |
| openGauss-server | CVE-2026-111441 在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >= lenUsed，也将 memcpy_s() 目标大小写成 lenUsed 而非实际分配的… |
8,1 | 0,4 % | Brak wpisu w KEV nie wyklucza ataków | |
| diem | CVE-2026-112042 A security flaw has been discovered in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This issue affects the function dmBaseLinkTag::text of the file dmCorePlugin/lib/view/html/link/dmBaseLinkTag.php of the component dmWidget. Performing a manipulation of the argument text… |
2,0 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| cal.com / cal.diy | CVE-2026-112043 A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass.… |
5,3 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 14.11.2026, 03:02 UTC – 14.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.