KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allows an authorized attacker to disclose information locally.
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally.
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.
Use after free in Windows Graphics Kernel allows an authorized attacker to disclose information locally.
Use after free in Windows Kernel allows an authorized attacker to disclose information locally.
Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally.
Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.
Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.
Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally.
Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.
Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally.
Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before…
Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally.
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorized_keys that, when…
Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,…
In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes,…
In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker… | Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,38 % | ||
| Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allows an authorized attacker to disclose… | Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,38 % | ||
| Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker… | Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,36 % | ||
| Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally. | Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,36 % | ||
| Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to… | Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,33 % | ||
| Use after free in Windows Graphics Kernel allows an authorized attacker to disclose information locally. | Use after free in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,32 % | ||
| Use after free in Windows Kernel allows an authorized attacker to disclose information locally. | Use after free in Windows Kernel allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,32 % | ||
| Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally. | Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,32 % | ||
| Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally. | Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,32 % | ||
| Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally. | Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,32 % | ||
| Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally. | Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,29 % | ||
| Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose… | Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,29 % | ||
| Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally. | Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally. |
Do wiadomości | 4,7 | 0,27 % | ||
| Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally. | Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,24 % | ||
| The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab'… | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated… |
Do wiadomości | 4,7 | 0,24 % | ||
| Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering… | Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. |
Do wiadomości | 4,7 | 0,24 % | ||
| Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally. | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,23 % | ||
| Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a… | Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before… |
Do wiadomości | 4,7 | 0,21 % | ||
| Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering… | Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally. |
Do wiadomości | 4,7 | 0,2 % | ||
| Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform… | Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. |
Do wiadomości | 4,7 | 0,2 % | ||
| muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the… | muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorized_keys that, when… |
Do wiadomości | 4,7 | 0,2 % | ||
| Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information… | Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,19 % | ||
| In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source… | In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,… |
Do wiadomości | 4,7 | 0,16 % | ||
| In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color… | In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes,… |
Do wiadomości | 4,7 | 0,16 % | ||
| In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are… | In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing… |
Do wiadomości | 4,7 | 0,16 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.