Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13 This makes it possible for unauthenticated attackers to delete arbitrary safe…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) handling logic. This allows a remote attacker to cause a denial of service.
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies.
A package release's…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Protection…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mg_tls_recv_record(), the…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer.
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
CVSS
7,5
EPSS
0,37 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13 This makes it possible for unauthenticated attackers to delete arbitrary safe…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) handling logic. This allows a remote attacker to cause a denial of service.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies.
A package release's…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Protection…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mg_tls_recv_record(), the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
7,5
0,37 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOstatnie przetworzenie zakończone
NVD · aktualizacjePrzetwarzanie niepełne
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOstatnie przetworzenie zakończoneData modelu znajduje się przy rekordzie.