Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: stop fast-leave after deleting a port group
br_multicast_leave_group() iterates mp->ports with pp = &p->next in
its fast-leave path. After br_multicast_del_pg() removes p,
continuing the loop advances pp through the…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks for `get_magic_quotes_gpc()`, a function…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for version 2.10.14. However, JNDI injection remains possible via the iiop, corbaname, and iiopname schemes. The vulnerability has been fixed…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl_setopt(CURLOPT_URL) without host or scheme validation. An unauthenticated remote attacker can leverage this to…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX. Successful attacks of this…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
An integer overflow vulnerability exists in the write method of the Buffer class in Robocode version 1.9.3.6. The method fails to properly validate the length of data being written, allowing attackers to cause an overflow, potentially leading to buffer overflows and arbitrary code execution. This…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
**UNSUPPORTED WHEN ASSIGNED**
JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an
application that puts it in front of an untrusted peer is open to gadget-chain RCE.
As the 3.0.0 branch is inactive, we do not plan…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback => '__return_true'` and performs no…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.
This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
CVSS
9,8
EPSS
0,57 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: stop fast-leave after deleting a port group
br_multicast_leave_group() iterates mp->ports with pp = &p->next in
its fast-leave path. After br_multicast_del_pg() removes p,
continuing the loop advances pp through the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks for `get_magic_quotes_gpc()`, a function…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database…
Opis źródłowy NVD · EN
Pilne działanie
CVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for version 2.10.14. However, JNDI injection remains possible via the iiop, corbaname, and iiopname schemes. The vulnerability has been fixed…
Opis źródłowy NVD · EN
Pilne działanie
CVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl_setopt(CURLOPT_URL) without host or scheme validation. An unauthenticated remote attacker can leverage this to…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX. Successful attacks of this…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
An integer overflow vulnerability exists in the write method of the Buffer class in Robocode version 1.9.3.6. The method fails to properly validate the length of data being written, allowing attackers to cause an overflow, potentially leading to buffer overflows and arbitrary code execution. This…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
**UNSUPPORTED WHEN ASSIGNED**
JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an
application that puts it in front of an untrusted peer is open to gadget-chain RCE.
As the 3.0.0 branch is inactive, we do not plan…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback => '__return_true'` and performs no…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.
This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
9,8
0,57 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.