Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal `"dev-secret-change-me"` when `PLATFORM_JWT_SECRET` is unset. A safety check exists but…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
Missing authentication for critical function vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to access resources which are not otherwise accessible without proper authentication.
We have already fixed the…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
svc_tcp_handshake() stores the raw svc_xprt pointer in
tls_handshake_args.ta_data and submits the request through
tls_server_hello_x509(). The handshake core…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
xdr_buf_to_bvec() writes a bio_vec into the caller's array before
testing whether that slot is in range, and the head branch performs
the store with no check at all.…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: wait for in-flight TLS handshake callback when cancel loses race
When wait_for_completion_interruptible_timeout() in
svc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and
tls_handshake_cancel() then…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens,…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Don't move a peeked OOB message onto the pending queue
rxrpc_recvmsg_oob() takes a received oob message off recvmsg_oobq and,
if a response is needed, moves it onto the pending_oobq tree. However,
only the unlink from…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
eth: fbnic: don't cache shinfo across skb realloc
fbnic_tx_lso() calls skb_cow_head() which may reallocate the skb
including the shared info. We can't use the pointer calculated
before the call.
BUG: KASAN:…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: harden rq_procinfo lifecycle to prevent double-free
The svc_release_rqst() function executes the callback inside
rqstp->rq_procinfo->pc_release. However, if a worker thread begins
processing a new request and encounters…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
tcp: defer md5sig_info kfree past RCU grace period in tcp_connect
The md5+ao reconciliation in tcp_connect() (net/ipv4/tcp_output.c)
has two symmetric branches:
if (needs_md5) {
tcp_ao_destroy_sock(sk, false);
} else if…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal `"dev-secret-change-me"` when `PLATFORM_JWT_SECRET` is unset. A safety check exists but…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
Missing authentication for critical function vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to access resources which are not otherwise accessible without proper authentication.
We have already fixed the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
svc_tcp_handshake() stores the raw svc_xprt pointer in
tls_handshake_args.ta_data and submits the request through
tls_server_hello_x509(). The handshake core…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
xdr_buf_to_bvec() writes a bio_vec into the caller's array before
testing whether that slot is in range, and the head branch performs
the store with no check at all.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: wait for in-flight TLS handshake callback when cancel loses race
When wait_for_completion_interruptible_timeout() in
svc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and
tls_handshake_cancel() then…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens,…
Opis źródłowy NVD · EN
Pilne działanie
CVSS 9,8 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Don't move a peeked OOB message onto the pending queue
rxrpc_recvmsg_oob() takes a received oob message off recvmsg_oobq and,
if a response is needed, moves it onto the pending_oobq tree. However,
only the unlink from…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
eth: fbnic: don't cache shinfo across skb realloc
fbnic_tx_lso() calls skb_cow_head() which may reallocate the skb
including the shared info. We can't use the pointer calculated
before the call.
BUG: KASAN:…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: harden rq_procinfo lifecycle to prevent double-free
The svc_release_rqst() function executes the callback inside
rqstp->rq_procinfo->pc_release. However, if a worker thread begins
processing a new request and encounters…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
tcp: defer md5sig_info kfree past RCU grace period in tcp_connect
The md5+ao reconciliation in tcp_connect() (net/ipv4/tcp_output.c)
has two symmetric branches:
if (needs_md5) {
tcp_ao_destroy_sock(sk, false);
} else if…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,63 % · rekomendacja wg zapisanej polityki