Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| diem | CVE-2026-112037 A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected is an unknown function of the file dmCorePlugin/lib/vendor/gapi/gapi.class.php of the component Google Analytics Client. Executing a manipulation can lead to improper certificate validation. The… |
2,9 | 0,18 % | Brak wpisu w KEV nie wyklucza ataków | |
| diem | CVE-2026-112038 A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this vulnerability is the function html of the file dmAdminPlugin/web/js/dmAdminCtrl.js of the component Version Check Service. The manipulation leads to cross site scripting. Remote… |
1,9 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| diem | CVE-2026-112039 A vulnerability was found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. The manipulation of the argument dm_command… |
1,9 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| diem | CVE-2026-112040 A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the component Sign-In. This manipulation of the argument Referer causes… |
2,1 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| diem | CVE-2026-112041 A vulnerability was identified in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This vulnerability affects the function dmString::random of the file dmCorePlugin/lib/basic/dmString.php. Such manipulation leads to cryptographically weak prng. The attack may be performed from… |
2,9 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| GV-ASManager | CVE-2026-108983 A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . |
9,8 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków | |
| GV-ASManager | CVE-2026-108984 A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . |
7,5 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| iWebShop-5 | CVE-2026-112034 A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/_userInfo/_userInfo.php of the component Login Redirect. This manipulation of the argument callback causes open redirect. The attack can be initiated… |
2,1 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| iWebShop-5 | CVE-2026-112035 A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send_message_mobile of the file controllers/simple.php. Such manipulation of the argument user_id leads to weak password recovery. The attack can be launched remotely. The exploit has been… |
2,1 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| MuPDF | CVE-2026-112036 A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be… |
2,1 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| iWebShop-5 | CVE-2026-112033 A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function admin_repwd/admin_repwd_act of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request… |
2,1 | 0,16 % | Brak wpisu w KEV nie wyklucza ataków | |
| LMS | CVE-2026-112031 A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack… |
2,0 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| iWebShop-5 | CVE-2026-112032 A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was… |
2,0 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| diem | CVE-2026-112030 A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remotely. The exploit has been made public… |
2,1 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| cms | CVE-2026-112027 A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file_exists of the file Public/Home/js/uploadify/check-exists.php of the component Uploadify. The manipulation of the… |
5,5 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| cms | CVE-2026-112028 A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.class.php of the component Vote Handler. This manipulation of the argument… |
5,5 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| diem | CVE-2026-112029 A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The… |
1,1 | 0,08 % | Brak wpisu w KEV nie wyklucza ataków | |
| Bootstrap Shortcodes | CVE-2026-112111 The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not… |
5,1 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| BIRD | CVE-2026-112112 An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD… |
2,3 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| cms | CVE-2026-112026 A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument Password leads to password hash with… |
2,9 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| cms | CVE-2026-112025 A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to… |
5,5 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| Gitea | CVE-2026-109844 `GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read… |
4,3 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| Gitea | CVE-2026-110311 Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time,… |
4,3 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| Gitea | CVE-2026-110324 The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the… |
6,5 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| Gitea | CVE-2026-110494 Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This… |
6,3 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 14.11.2026, 03:02 UTC – 14.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.