Podatności

CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFI_stridx_c to scan past…

CVSS 3,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the…

CVSS 3,3 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking…

CVSS 3,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiword…

CVSS 3,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This…

CVSS 3,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the VeraCrypt Windows veracrypt.sys driver accept caller-supplied object-manager and device paths broader than supported VeraCrypt workflows require. A local user…

CVSS 3,3 · EPSS 0,1 % · rekomendacja wg zapisanej polityki

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle…

CVSS 3,3 · rekomendacja wg zapisanej polityki

IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.

CVSS 3,1 · EPSS 0,62 % · rekomendacja wg zapisanej polityki

miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP…

CVSS 3,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so…

CVSS 3,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a…

CVSS 3,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVSS 3,1 · EPSS 0,18 % · rekomendacja wg zapisanej polityki

Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that…

CVSS 3,1 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after…

CVSS 3,1 · EPSS 0,1 % · rekomendacja wg zapisanej polityki

IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected.

CVSS 3,1 · rekomendacja wg zapisanej polityki

A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2. The impacted element is the function requireAdminWrite of the file Memory/src/server/http.ts of the component Memory Service. This manipulation causes resource consumption. Remote exploitation of the attack is…

CVSS 3,1 · rekomendacja wg zapisanej polityki

A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career Portal. This manipulation of the argument applyToJobSubAction causes improper restriction of excessive authentication attempts. Remote exploitation of…

CVSS 2,9 · EPSS 0,48 % · rekomendacja wg zapisanej polityki

A vulnerability was identified in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This vulnerability affects the function dmString::random of the file dmCorePlugin/lib/basic/dmString.php. Such manipulation leads to cryptographically weak prng. The attack may be performed from…

CVSS 2,9 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.__write_feed_metadata_sync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery.…

CVSS 2,9 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected is an unknown function of the file dmCorePlugin/lib/vendor/gapi/gapi.class.php of the component Google Analytics Client. Executing a manipulation can lead to improper certificate validation. The…

CVSS 2,9 · EPSS 0,18 % · rekomendacja wg zapisanej polityki

rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted size_t indexes to int before adding them to std::vector iterators. On 64-bit systems, in a CSV matrix dimension containing more than 2^31 elements, an index above…

CVSS 2,9 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server.

CVSS 2,8 · EPSS 0,09 % · rekomendacja wg zapisanej polityki

The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts…

CVSS 2,7 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail…

CVSS 2,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata…

CVSS 2,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki