Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| lotus | CVE-2026-115332 Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted… |
8,7 | 0,45 % | Brak wpisu w KEV nie wyklucza ataków | |
| lotus | CVE-2026-115333 Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/… |
8,2 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| lotus | CVE-2026-115334 Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/… |
7,6 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| Mattermost | CVE-2026-13411 Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash the Playbooks plugin instance-wide via a crafted import request containing a null condition. Mattermost Advisory ID: MMSA-2026-00709 |
4,3 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| evershop | CVE-2026-115323 EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to… |
6,9 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| mem0 | CVE-2026-115324 mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string… |
9,2 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| netmaker | CVE-2026-115325 Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to… |
8,7 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| QloApps | CVE-2026-115326 QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values… |
5,3 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| libyang | CVE-2026-115327 libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like… |
6,0 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| json-scada | CVE-2026-115328 JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read,… |
8,7 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| patch / Red Hat Hardened Images | CVE-2026-115207 A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers… |
5,5 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| fzf | CVE-2026-115319 fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated… |
2,0 | 0,1 % | Brak wpisu w KEV nie wyklucza ataków | |
| bytebase | CVE-2026-115321 Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own… |
5,3 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| bytebase | CVE-2026-115322 Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read… |
5,3 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| goploy | CVE-2026-114665 Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read… |
7,1 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| Rootblox | CVE-2026-112832 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6. |
9,8 | 0,44 % | Brak wpisu w KEV nie wyklucza ataków | |
| Paid Member Subscriptions | CVE-2026-112842 Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2. |
6,5 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| Workreap Core | CVE-2026-112822 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4. |
8,5 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| Academist Core | CVE-2026-112820 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1. |
8,1 | 0,44 % | Brak wpisu w KEV nie wyklucza ataków | |
| ACF Extended | CVE-2026-112313 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7. |
7,1 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| goose | CVE-2026-111079 A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens,… |
7,4 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| Retool | CVE-2024-58394 Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a… |
5,1 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| CPAS Audit Management System | CVE-2024-58396 YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with ../ sequences in fileId to retrieve… |
8,7 | 0,5 % | Brak wpisu w KEV nie wyklucza ataków | |
| E-cology | CVE-2025-71434 Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via… |
8,8 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| YiShaAdmin | CVE-2022-51022 YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory… |
8,8 | 0,79 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 15.11.2026, 07:02 UTC – 15.11.2026, 12:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.