Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forwarded, unauthenticated attackers can send a…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted and Self-hosted were found to be vulnerable.
This issue has already been mitigated for Looker-hosted.
Self-hosted instances must be…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,95 % · rekomendacja wg zapisanej polityki
Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,45 % · rekomendacja wg zapisanej polityki
SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument wizard causes os command injection. It is possible to initiate the attack remotely. The exploit has…
Opis źródłowy NVD · ENCVSS 8,9 · EPSS 1,95 % · rekomendacja wg zapisanej polityki
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 3,44 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the run_tcpdump in file /usr/lib/lua/luci/controller/admin/common_tcpdump.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,44 % · rekomendacja wg zapisanej polityki
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services,…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute
local file path.
This issue was fixed in version V4.
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
CVSS
9,2
EPSS
0,42 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forwarded, unauthenticated attackers can send a…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted and Self-hosted were found to be vulnerable.
This issue has already been mitigated for Looker-hosted.
Self-hosted instances must be…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,95 % · rekomendacja wg zapisanej polityki
Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 2,45 % · rekomendacja wg zapisanej polityki
SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument wizard causes os command injection. It is possible to initiate the attack remotely. The exploit has…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,9 · EPSS 1,95 % · rekomendacja wg zapisanej polityki
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 3,44 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the run_tcpdump in file /usr/lib/lua/luci/controller/admin/common_tcpdump.lua.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 2,44 % · rekomendacja wg zapisanej polityki
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services,…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute
local file path.
This issue was fixed in version V4.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
9,2
0,42 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.