Subscriber Settings Change in uListing <= 2.2.0 versions.
Subscriber Settings Change in uListing <= 2.2.0 versions.
- CVSS
- 7,6
- EPSS
- 0,3 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
KATALOG INFORMACJI
Podatności
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Filtry katalogu · zakres, producent, rekomendacja
Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions.
Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions.
- CVSS
- 7,6
- EPSS
- 0,29 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.
Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.
- CVSS
- 7,6
- EPSS
- 0,28 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.
Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.
- CVSS
- 7,6
- EPSS
- 0,28 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Administrator SQL Injection in Leyka <= 3.32.3 versions.
Administrator SQL Injection in Leyka <= 3.32.3 versions.
- CVSS
- 7,6
- EPSS
- 0,28 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
- CVSS
- 7,5
- EPSS
- 0,77 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- CVSS
- 7,5
- EPSS
- 0,77 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny…
Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- CVSS
- 7,5
- EPSS
- 0,77 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
- CVSS
- 7,5
- EPSS
- 0,77 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session…
Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change…
- CVSS
- 7,6
- EPSS
- 0,25 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- CVSS
- 7,5
- EPSS
- 0,74 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to…
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or…
- CVSS
- 7,6
- EPSS
- 0,24 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1.
- CVSS
- 7,6
- EPSS
- 0,24 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
- CVSS
- 7,6
- EPSS
- 0,23 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
OpenRemote is an open-source internet-of-things platform.
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and…
- CVSS
- 7,6
- EPSS
- 0,22 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
- CVSS
- 7,6
- EPSS
- 0,22 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Tina is a headless content management system.
Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable…
- CVSS
- 7,6
- EPSS
- 0,21 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients.
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP…
- CVSS
- 7,5
- EPSS
- 0,7 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a…
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
- CVSS
- 7,5
- EPSS
- 0,69 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
- CVSS
- 7,5
- EPSS
- 0,69 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up…
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing…
- CVSS
- 7,5
- EPSS
- 0,69 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.
A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.
- CVSS
- 7,6
- EPSS
- 0,18 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated…
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.
- CVSS
- 7,5
- EPSS
- 0,66 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network.
Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network.
- CVSS
- 7,5
- EPSS
- 0,66 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network.
Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network.
- CVSS
- 7,5
- EPSS
- 0,66 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Subscriber Settings Change in uListing <= 2.2.0 versions. | Subscriber Settings Change in uListing <= 2.2.0 versions. |
Obserwuj | 7,6 | 0,3 % | ||
| Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. | Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. |
Obserwuj | 7,6 | 0,29 % | ||
| Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions. | Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions. |
Obserwuj | 7,6 | 0,28 % | ||
| Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions. | Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions. |
Obserwuj | 7,6 | 0,28 % | ||
| Administrator SQL Injection in Leyka <= 3.32.3 versions. | Administrator SQL Injection in Leyka <= 3.32.3 versions. |
Obserwuj | 7,6 | 0,28 % | ||
| Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,77 % | ||
| Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,77 % | ||
| Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny… | Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,77 % | ||
| Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,77 % | ||
| Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session… | Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change… |
Obserwuj | 7,6 | 0,25 % | ||
| No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. |
Obserwuj | 7,5 | 0,74 % | ||
| MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to… | MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or… |
Obserwuj | 7,6 | 0,24 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1. |
Obserwuj | 7,6 | 0,24 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7. |
Obserwuj | 7,6 | 0,23 % | ||
| OpenRemote is an open-source internet-of-things platform. | OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and… |
Obserwuj | 7,6 | 0,22 % | ||
| OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field | OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field |
Obserwuj | 7,6 | 0,22 % | ||
| Tina is a headless content management system. | Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable… |
Obserwuj | 7,6 | 0,21 % | ||
| The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP… |
Obserwuj | 7,5 | 0,7 % | ||
| Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a… | Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network. |
Obserwuj | 7,5 | 0,69 % | ||
| Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network. | Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network. |
Obserwuj | 7,5 | 0,69 % | ||
| The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up… | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing… |
Obserwuj | 7,5 | 0,69 % | ||
| A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data. | A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data. |
Obserwuj | 7,6 | 0,18 % | ||
| A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated… | A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site. |
Obserwuj | 7,5 | 0,66 % | ||
| Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network. | Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network. |
Obserwuj | 7,5 | 0,66 % | ||
| Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network. | Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network. |
Obserwuj | 7,5 | 0,66 % |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOstatnie przetworzenie zakończone
NVD · aktualizacjeOstatnie przetworzenie zakończone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOstatnie przetworzenie zakończoneData modelu znajduje się przy rekordzie.