Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Settings/Updates Livewire component does not check isInstanceAdmin in its mount method, allowing non-admin users to access the Updates settings page and potentially…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer (REST) API endpoint for lookup…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage.…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted source, could induce the model to construct a remote image…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Settings/Updates Livewire component does not check isInstanceAdmin in its mount method, allowing non-admin users to access the Updates settings page and potentially…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer (REST) API endpoint for lookup…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted source, could induce the model to construct a remote image…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki