Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP…
Opis źródłowy NVD · ENCVSS 7,4 · EPSS 0,14 % · rekomendacja wg zapisanej polityki
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Opis źródłowy NVD · ENCVSS 7,3 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing…
Opis źródłowy NVD · ENCVSS 7,3 · EPSS 0,53 % · rekomendacja wg zapisanej polityki
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
Opis źródłowy NVD · ENCVSS 7,4 · rekomendacja wg zapisanej polityki
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into…
Opis źródłowy NVD · ENCVSS 7,4 · rekomendacja wg zapisanej polityki
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler…
Opis źródłowy NVD · ENCVSS 7,4 · rekomendacja wg zapisanej polityki
A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create…
Opis źródłowy NVD · ENCVSS 7,4 · rekomendacja wg zapisanej polityki
undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent…
Opis źródłowy NVD · ENCVSS 7,4 · rekomendacja wg zapisanej polityki
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from…
Opis źródłowy NVD · ENCVSS 7,4 · rekomendacja wg zapisanej polityki
A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers…
Opis źródłowy NVD · ENCVSS 7,3 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been…
Opis źródłowy NVD · ENCVSS 7,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.
Opis źródłowy NVD · ENCVSS 7,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. The…
Opis źródłowy NVD · ENCVSS 7,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection.…
Opis źródłowy NVD · ENCVSS 7,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in…
Opis źródłowy NVD · ENCVSS 7,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly…
Opis źródłowy NVD · ENCVSS 7,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project.
This vulnerability…
Opis źródłowy NVD · ENCVSS 7,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
CVSS
7,3
EPSS
0,36 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,4 · EPSS 0,14 % · rekomendacja wg zapisanej polityki
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,3 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,3 · EPSS 0,53 % · rekomendacja wg zapisanej polityki
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into…
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler…
A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create…
undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent…
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from…
A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,3 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. The…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project.
This vulnerability…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
7,3
0,36 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjePrzetwarzanie niepełne
NVD · aktualizacjePrzetwarzanie niepełne
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOstatnie przetworzenie zakończoneData modelu znajduje się przy rekordzie.