Publikacje w kolejności czasu
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| traefik | CVE-2026-114637 Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend… |
7,0 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| traefik | CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its… |
7,0 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| traefik | CVE-2026-114639 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on… |
7,0 | 0,3 % | Brak wpisu w KEV nie wyklucza ataków | |
| traefik | CVE-2026-114640 Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream,… |
7,0 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| RE6250 | CVE-2026-114576 A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation of the argument session_id leads to insufficiently random values. The attack may be initiated remotely. The complexity of an attack is rather… |
2,9 | 0,5 % | Brak wpisu w KEV nie wyklucza ataków | |
| php-travel-agency-system | CVE-2026-114577 A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/description/user/uploadimage/full_name/visa_no results in sql… |
5,5 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| AVideo | CVE-2026-114633 WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and… |
7,0 | 0,44 % | Brak wpisu w KEV nie wyklucza ataków | |
| AVideo | CVE-2026-114634 WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-validating targets with isSSRFSafeURL(). Authenticated uploaders can store a videoLink pointing to a redirector, causing internal… |
5,3 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| GitLab | CVE-2026-12664 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a read_api-scoped token to retrieve a project's incoming email address and create… |
6,8 | 0,4 % | Brak wpisu w KEV nie wyklucza ataków | |
| GitLab | CVE-2026-13319 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects… |
6,5 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| GitLab | CVE-2026-14288 GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access… |
3,1 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| GitLab | CVE-2026-15723 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any… |
8,2 | 0,54 % | Brak wpisu w KEV nie wyklucza ataków | |
| GitLab | CVE-2026-16255 GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside… |
7,1 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| GitLab | CVE-2026-112378 GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side… |
4,3 | 0,13 % | Brak wpisu w KEV nie wyklucza ataków | |
| massCode | CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been… |
2,1 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| A950RG | CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has… |
9,3 | 2,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| Webmail | CVE-2026-114714 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause… |
5,3 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| GitLab | CVE-2026-103515 GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data… |
2,7 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| GitLab | CVE-2026-105711 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could… |
3,5 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| GitLab | CVE-2026-105777 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal… |
6,5 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| GitLab | CVE-2026-110264 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to… |
10,0 | 1,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| GitLab | CVE-2026-112212 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an… |
7,5 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| GitLab | CVE-2026-112326 GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete existing vulnerability records due to… |
3,1 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| Splunk SOAR | CVE-2026-76530 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by… |
8,8 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| Splunk SOAR | CVE-2026-76531 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by… |
9,9 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 15.11.2026, 15:02 UTC – 15.11.2026, 20:17 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.