Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Qsirch 7.0.3.0 and later
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system.…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
CVSS
9,3
EPSS
0,42 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Qsirch 7.0.3.0 and later
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
9,3
0,42 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.