KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally.
Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.
Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.
Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally.
Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.
Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally.
Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before…
Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally.
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorized_keys that, when…
Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,…
In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes,…
In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing…
A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the…
In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject…
A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary…
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allowed glob that resolves into a denied…
A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect…
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally. | Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,32 % | ||
| Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally. | Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,32 % | ||
| Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally. | Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,32 % | ||
| Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally. | Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,29 % | ||
| Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose… | Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,29 % | ||
| Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally. | Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally. |
Do wiadomości | 4,7 | 0,27 % | ||
| Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally. | Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,24 % | ||
| The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab'… | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated… |
Do wiadomości | 4,7 | 0,24 % | ||
| Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering… | Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. |
Do wiadomości | 4,7 | 0,24 % | ||
| Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally. | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,23 % | ||
| Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a… | Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before… |
Do wiadomości | 4,7 | 0,21 % | ||
| Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering… | Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally. |
Do wiadomości | 4,7 | 0,2 % | ||
| Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform… | Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. |
Do wiadomości | 4,7 | 0,2 % | ||
| muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the… | muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorized_keys that, when… |
Do wiadomości | 4,7 | 0,2 % | ||
| Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information… | Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
Do wiadomości | 4,7 | 0,19 % | ||
| In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source… | In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,… |
Do wiadomości | 4,7 | 0,16 % | ||
| In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color… | In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes,… |
Do wiadomości | 4,7 | 0,16 % | ||
| In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are… | In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing… |
Do wiadomości | 4,7 | 0,16 % | ||
| A flaw was found in the clevis PKCS#11 pin. | A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the… |
Do wiadomości | 4,7 | 0,13 % | ||
| In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely… | In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject… |
Do wiadomości | 4,7 | 0,13 % | ||
| A flaw was found in the clevis PKCS#11 pin. | A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem. |
Do wiadomości | 4,7 | 0,13 % | ||
| A flaw was found in the clevis PKCS#11 pin. | A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary… |
Do wiadomości | 4,7 | 0,12 % | ||
| obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allowed glob that resolves into a denied… |
Do wiadomości | 4,7 | 0,11 % | ||
| A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged… | A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect… |
Do wiadomości | 4,7 | 0,11 % | ||
| A flaw was found in the clevis PKCS#11 pin. | A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk… |
Do wiadomości | 4,7 | 0,1 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.