Podatności

Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting…

CVSS 7,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.

CVSS 7,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.

CVSS 7,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt…

CVSS 7,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces.

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATA_FIRST message on an opened DVC declaring a large 32-bit length,…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via crafted packets when the static MAC-IP feature is in use.

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses,…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain…

CVSS 7,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys_log table,…

CVSS 7,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to…

CVSS 7,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in…

CVSS 7,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN…

CVSS 7,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth…

CVSS 7,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does…

CVSS 7,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to…

CVSS 7,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Block2 response when _block_cb() sees…

CVSS 7,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF.

CVSS 7,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.

CVSS 7,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki