KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Bindings in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Brak walidacji nonce w wtyczce AI Engine umożliwia atakującym tworzenie kont administratorów.
Wykorzystanie błędu use after free w V8 w Google Chrome pozwala na zdalne wykonanie kodu.
Nieodpowiednia implementacja w V8 w Google Chrome umożliwia zdalnemu atakującemu dowolne odczyty i zapisy.
Wykonanie zdalnego kodu w Craft CMS umożliwia atakującemu z autoryzowanym dostępem do panelu.
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings`…
Incorrect Privilege Assignment vulnerability in AA-Team Premium Age Verification / Restriction for WordPress, AA-Team Responsive Coming Soon Landing Page / Holding Page for WordPress allows Privilege Escalation.This issue affects Premium Age Verification / Restriction for WordPress: from n/a…
Wstrzyknięcie kodu w CloudLinux ai-bolit umożliwia nadpisanie plików jako root.
W BrowserStack Runner występuje podatność na zdalne wykonanie kodu przez nieautoryzowanych atakujących.
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.
A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to bypass file integrity validation via a crafted request. By providing a valid hash for a malicious file, an attacker can cause the…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an… | The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin. |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via… | Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a… | Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox… | Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via… | Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the… | Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially… | Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the… | Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute… | Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a… | Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Obserwuj | 8,8 | 0,3 % | ||
| Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code… | Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via… | Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in Bindings in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox… | Use after free in Bindings in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,3 % | ||
| Brak walidacji nonce w wtyczce AI Engine umożliwia atakującym tworzenie kont administratorów. | Brak walidacji nonce w wtyczce AI Engine umożliwia atakującym tworzenie kont administratorów. |
Obserwuj | 8,8 | 0,3 % | ||
| Wykorzystanie błędu use after free w V8 w Google Chrome pozwala na zdalne wykonanie kodu. | Wykorzystanie błędu use after free w V8 w Google Chrome pozwala na zdalne wykonanie kodu. |
Obserwuj | 8,8 | 0,3 % | ||
| Nieodpowiednia implementacja w V8 w Google Chrome umożliwia zdalnemu atakującemu dowolne odczyty i zapisy. | Nieodpowiednia implementacja w V8 w Google Chrome umożliwia zdalnemu atakującemu dowolne odczyty i zapisy. |
Obserwuj | 8,8 | 0,3 % | ||
| Wykonanie zdalnego kodu w Craft CMS umożliwia atakującemu z autoryzowanym dostępem do panelu. | Wykonanie zdalnego kodu w Craft CMS umożliwia atakującemu z autoryzowanym dostępem do panelu. |
Obserwuj | 8,7 | 0,8 % | ||
| The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege… | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings`… |
Obserwuj | 8,8 | 0,3 % | ||
| Incorrect Privilege Assignment vulnerability in AA-Team Premium Age Verification / Restriction for WordPress, AA-Team Responsive Coming… | Incorrect Privilege Assignment vulnerability in AA-Team Premium Age Verification / Restriction for WordPress, AA-Team Responsive Coming Soon Landing Page / Holding Page for WordPress allows Privilege Escalation.This issue affects Premium Age Verification / Restriction for WordPress: from n/a… |
Obserwuj | 8,8 | 0,3 % | ||
| Wstrzyknięcie kodu w CloudLinux ai-bolit umożliwia nadpisanie plików jako root. | Wstrzyknięcie kodu w CloudLinux ai-bolit umożliwia nadpisanie plików jako root. |
Obserwuj | 8,8 | 0,3 % | ||
| W BrowserStack Runner występuje podatność na zdalne wykonanie kodu przez nieautoryzowanych atakujących. | W BrowserStack Runner występuje podatność na zdalne wykonanie kodu przez nieautoryzowanych atakujących. |
Obserwuj | 8,7 | 0,8 % | ||
| Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup… | Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1. |
Obserwuj | 8,8 | 0,3 % | ||
| Use-after-free in the JavaScript: WebAssembly component. | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
Obserwuj | 8,8 | 0,3 % | ||
| In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL… | In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability. |
Obserwuj | 8,8 | 0,3 % | ||
| A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for… | A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to bypass file integrity validation via a crafted request. By providing a valid hash for a malicious file, an attacker can cause the… |
Obserwuj | 8,8 | 0,3 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.