Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.3.
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Discourse Doc Categories is a plugin for organizing Discourse topics as documentation. Prior to the verified source fix, the doc category index refresh resolves linked titles for private messages or restricted category topics without enforcing the viewer's authorization. A user who can edit the…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
A potential security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server could be remotely exploited to list and modify RMC filesystem.
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the redfish_certificate resource component. A high privileged attacker with remote access could potentially exploit this vulnerability, leading…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
CVSS
4,3
EPSS
0,16 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.3.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Discourse Doc Categories is a plugin for organizing Discourse topics as documentation. Prior to the verified source fix, the doc category index refresh resolves linked titles for private messages or restricted category topics without enforcing the viewer's authorization. A user who can edit the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
A potential security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server could be remotely exploited to list and modify RMC filesystem.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the redfish_certificate resource component. A high privileged attacker with remote access could potentially exploit this vulnerability, leading…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
4,3
0,16 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.