KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any…
RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can…
Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting…
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete…
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with…
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del…
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to…
Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can…
Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.18.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2.
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star…
ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body…
Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_reports on one site…
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.65.
Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit
Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API…
Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view_server_log.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request…
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token…
An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.
DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path…
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability. A high privileged attacker with adjacent network access could potentially…
Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials. This issue affects Vatos DLP: from 1.1.176 before 1.1.243.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-119658 PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a… |
Pozostałe |
CVSS 5,3EPSS 0,41 % | ||
| CVE-2026-119647 RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments.… |
Pozostałe |
CVSS 5,3EPSS 0,31 % | ||
| CVE-2026-119648 Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST… |
Pozostałe |
CVSS 5,3EPSS 0,29 % | ||
| CVE-2026-119649 Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to… |
Monitoruj |
CVSS 7,1EPSS 0,36 % | ||
| CVE-2026-119650 HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by… |
Pozostałe |
CVSS 5,3EPSS 0,3 % | ||
| CVE-2026-119651 HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying… |
Pozostałe |
CVSS 5,3EPSS 0,31 % | ||
| CVE-2026-119652 HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by… |
Pozostałe |
CVSS 5,3EPSS 0,28 % | ||
| CVE-2026-119653 Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged… |
Pozostałe |
CVSS 5,3EPSS 0,35 % | ||
| CVE-2026-119368 Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
Pozostałe |
CVSS 5,3EPSS 0,31 % | ||
| CVE-2026-119370 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This… |
Pozostałe |
CVSS 6,5EPSS 0,17 % | ||
| CVE-2026-119482 Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder:… |
Pozostałe |
CVSS 5,3EPSS 0,27 % | ||
| CVE-2026-119644 Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids.… |
Pozostałe |
CVSS 5,3EPSS 0,33 % | ||
| CVE-2026-119645 ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks.… |
Monitoruj |
CVSS 7,1EPSS 0,39 % | ||
| CVE-2026-119646 Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are… |
Pozostałe |
CVSS 5,3EPSS 0,46 % | ||
| CVE-2026-116860 Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through… |
Pozostałe |
CVSS 5,3EPSS 0,24 % | ||
| CVE-2026-117346 Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit |
Monitoruj |
CVSS 7,5EPSS 0,2 % | ||
| CVE-2026-117349 Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue. |
Pozostałe |
CVSS 5,3EPSS 0,3 % | ||
| CVE-2026-112905 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any… |
Wysoki priorytet |
CVSS 9,0EPSS 0,5 % | ||
| CVE-2015-20130 Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view_server_log.php that allows remote attackers to execute… |
Pozostałe |
CVSS 5,1EPSS 0,29 % | ||
| CVE-2026-110799 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an… |
Wysoki priorytet |
CVSS 9,8EPSS 0,71 % | ||
| CVE-2026-111487 An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module. |
Pozostałe |
CVSS 4,3EPSS 0,13 % | ||
| CVE-2010-20125 DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the… |
Monitoruj |
CVSS 8,7EPSS 0,55 % | ||
| CVE-2026-91915 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability. A high… |
Pozostałe |
CVSS 6,8EPSS 0,28 % | ||
| CVE-2026-86715 Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials. This issue affects… |
Monitoruj |
CVSS 7,1EPSS 0,13 % | ||
| CVE-2026-91912 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with local access could potentially exploit… |
Pozostałe |
CVSS 6,5EPSS 0,12 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 15:02 UTC – 12.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.