KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck…
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in…
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the…
Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve…
Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can…
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository…
Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css_selector and wait_for fields. Attackers can inject…
Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to…
ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing…
Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.
Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.
Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.
Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output…
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.
Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.
Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.
Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.
Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-119128 ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any… |
Wysoki priorytet |
CVSS 9,1EPSS 0,29 % | ||
| CVE-2026-119129 ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a… |
Monitoruj |
CVSS 8,6EPSS 0,28 % | ||
| CVE-2026-119130 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written… |
Pozostałe |
CVSS 2,1EPSS 0,24 % | ||
| CVE-2026-119118 Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with… |
Monitoruj |
CVSS 8,3EPSS 0,19 % | ||
| CVE-2026-119119 Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range… |
Monitoruj |
CVSS 8,7EPSS 0,36 % | ||
| CVE-2026-119120 Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace… |
Monitoruj |
CVSS 7,7EPSS 0,42 % | ||
| CVE-2026-119121 Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page… |
Pozostałe |
CVSS 5,3EPSS 0,29 % | ||
| CVE-2026-119122 Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness.… |
Pozostałe |
CVSS 6,9EPSS 0,37 % | ||
| CVE-2026-119123 ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for… |
Monitoruj |
CVSS 7,5EPSS 0,35 % | ||
| CVE-2026-118082 Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. |
Monitoruj |
CVSS 8,8EPSS 0,36 % | ||
| CVE-2026-118083 Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. |
Monitoruj |
CVSS 7,5EPSS 0,3 % | ||
| CVE-2026-118084 Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions. |
Pozostałe |
CVSS 6,5EPSS 0,33 % | ||
| CVE-2026-118085 Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions. |
Monitoruj |
CVSS 7,1EPSS 0,18 % | ||
| CVE-2026-118673 KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in… |
Pozostałe |
CVSS 4,1EPSS 0,11 % | ||
| CVE-2026-118074 Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions. |
Monitoruj |
CVSS 7,2EPSS 0,3 % | ||
| CVE-2026-118075 Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions. |
Monitoruj |
CVSS 8,8EPSS 0,37 % | ||
| CVE-2026-118076 Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions. |
Monitoruj |
CVSS 8,8EPSS 0,37 % | ||
| CVE-2026-118077 Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions. |
Monitoruj |
CVSS 7,2EPSS 0,3 % | ||
| CVE-2026-118078 Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions. |
Monitoruj |
CVSS 7,2EPSS 0,3 % | ||
| CVE-2026-118079 Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player:… |
Monitoruj |
CVSS 7,2EPSS 0,3 % | ||
| CVE-2026-118080 Contributor PHP Object Injection in Social Snap <= 1.5.4 versions. |
Monitoruj |
CVSS 8,8EPSS 0,37 % | ||
| CVE-2026-118081 Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions. |
Monitoruj |
CVSS 8,8EPSS 0,37 % | ||
| CVE-2026-116864 Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions. |
Monitoruj |
CVSS 7,2EPSS 0,3 % | ||
| CVE-2026-116865 Editor PHP Object Injection in Zippy <= 1.7.0 versions. |
Monitoruj |
CVSS 7,2EPSS 0,3 % | ||
| CVE-2026-116866 Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions. |
Monitoruj |
CVSS 8,8EPSS 0,29 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 8.11.2026, 15:32 UTC – 8.11.2026, 17:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.