CVE-2025-45528
An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF
MonitorujOpis źródłowy · EN
- CVSS
- 7,3
- EPSS
- 0,16 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
KATALOG PODATNOŚCI
Publikacje w kolejności czasu
Chronologiczny przegląd publikacji. Ostatnie modyfikacje są w osobnym widoku.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
CVE-2026-58497
Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin…
MonitorujOpis źródłowy · EN
- CVSS
- 8,6
- EPSS
- 0,26 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-55457
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter…
MonitorujOpis źródłowy · EN
- CVSS
- 7,4
- EPSS
- 0,27 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-55459
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as…
MonitorujOpis źródłowy · EN
- CVSS
- 7,4
- EPSS
- 0,21 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-55463
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint,…
PozostałeOpis źródłowy · EN
- CVSS
- 6,5
- EPSS
- 0,14 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-55465
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/{solrField}/spatial/search concatenates the user-supplied…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,26 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-55486
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query…
Wysoki priorytetOpis źródłowy · EN
- CVSS
- 9,3
- EPSS
- 0,26 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-49442
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,24 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-53942
Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is…
Wysoki priorytetOpis źródłowy · EN
- CVSS
- 9,9
- EPSS
- 0,33 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-54668
Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the…
MonitorujOpis źródłowy · EN
- CVSS
- 8,7
- EPSS
- 0,3 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-55222
Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user (the…
PozostałeOpis źródłowy · EN
- CVSS
- 5,1
- EPSS
- 0,13 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-55442
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,26 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-55444
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,25 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-46346
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address…
PozostałeOpis źródłowy · EN
- CVSS
- 6,5
- EPSS
- 0,33 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-46347
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the…
PozostałeOpis źródłowy · EN
- CVSS
- 6,8
- EPSS
- 0,25 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-46531
Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm…
PozostałeOpis źródłowy · EN
- CVSS
- 5,5
- EPSS
- 0,3 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-46651
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts…
Wysoki priorytetOpis źródłowy · EN
- CVSS
- 9,8
- EPSS
- 0,38 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-46652
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied…
Wysoki priorytetOpis źródłowy · EN
- CVSS
- 9,8
- EPSS
- 0,7 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-115478
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed…
MonitorujOpis źródłowy · EN
- CVSS
- 7,1
- EPSS
- 0,32 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-39902
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an…
MonitorujOpis źródłowy · EN
- CVSS
- 7,2
- EPSS
- 0,4 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-115477
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a 2026-07-28-era client declaring `elicitation.form` support, a…
MonitorujOpis źródłowy · EN
- CVSS
- 7,1
- EPSS
- 0,35 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-112333
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to…
PozostałeOpis źródłowy · EN
- CVSS
- 5,1
- EPSS
- 0,14 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-106763
An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.
MonitorujOpis źródłowy · EN
- CVSS
- 7,5
- EPSS
- 0,52 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-106764
An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.
MonitorujOpis źródłowy · EN
- CVSS
- 7,5
- EPSS
- 0,52 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-106765
An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.
MonitorujOpis źródłowy · EN
- CVSS
- 7,5
- EPSS
- 0,5 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2025-45528 An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF |
Monitoruj |
CVSS 7,3EPSS 0,16 % | ||
| CVE-2026-58497 Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy… |
Monitoruj |
CVSS 8,6EPSS 0,26 % | ||
| CVE-2026-55457 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when… |
Monitoruj |
CVSS 7,4EPSS 0,27 % | ||
| CVE-2026-55459 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken… |
Monitoruj |
CVSS 7,4EPSS 0,21 % | ||
| CVE-2026-55463 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in… |
Pozostałe |
CVSS 6,5EPSS 0,14 % | ||
| CVE-2026-55465 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET… |
Pozostałe |
CVSS 5,3EPSS 0,26 % | ||
| CVE-2026-55486 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login… |
Wysoki priorytet |
CVSS 9,3EPSS 0,26 % | ||
| CVE-2026-49442 Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti… |
Pozostałe |
CVSS 5,3EPSS 0,24 % | ||
| CVE-2026-53942 Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in… |
Wysoki priorytet |
CVSS 9,9EPSS 0,33 % | ||
| CVE-2026-54668 Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes… |
Monitoruj |
CVSS 8,7EPSS 0,3 % | ||
| CVE-2026-55222 Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy… |
Pozostałe |
CVSS 5,1EPSS 0,13 % | ||
| CVE-2026-55442 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr… |
Pozostałe |
CVSS 5,3EPSS 0,26 % | ||
| CVE-2026-55444 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q… |
Pozostałe |
CVSS 5,3EPSS 0,25 % | ||
| CVE-2026-46346 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of… |
Pozostałe |
CVSS 6,5EPSS 0,33 % | ||
| CVE-2026-46347 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application… |
Pozostałe |
CVSS 6,8EPSS 0,25 % | ||
| CVE-2026-46531 Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the… |
Pozostałe |
CVSS 5,5EPSS 0,3 % | ||
| CVE-2026-46651 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket… |
Wysoki priorytet |
CVSS 9,8EPSS 0,38 % | ||
| CVE-2026-46652 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename()… |
Wysoki priorytet |
CVSS 9,8EPSS 0,7 % | ||
| CVE-2026-115478 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and… |
Monitoruj |
CVSS 7,1EPSS 0,32 % | ||
| CVE-2026-39902 Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect operators,… |
Monitoruj |
CVSS 7,2EPSS 0,4 % | ||
| CVE-2026-115477 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a… |
Monitoruj |
CVSS 7,1EPSS 0,35 % | ||
| CVE-2026-112333 GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary… |
Pozostałe |
CVSS 5,1EPSS 0,14 % | ||
| CVE-2026-106763 An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions. |
Monitoruj |
CVSS 7,5EPSS 0,52 % | ||
| CVE-2026-106764 An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function. |
Monitoruj |
CVSS 7,5EPSS 0,52 % | ||
| CVE-2026-106765 An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function. |
Monitoruj |
CVSS 7,5EPSS 0,5 % |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 9.11.2026, 03:32 UTC – 9.11.2026, 05:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.
NVD · publikacjeOstatnie przetworzenie zakończone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOstatnie przetworzenie zakończoneData modelu znajduje się przy rekordzie.