KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose…
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file…
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to…
OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker…
OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values,…
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or…
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched…
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many…
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time,…
Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens. Attackers who can plant an HTML file readable by the renderer can reference it via…
Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like…
A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply…
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can…
A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that…
A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later…
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for…
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party…
A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size…
The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the…
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches…
The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides…
A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion…
Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from…
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an…
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-115354 Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths.… |
Monitoruj |
CVSS 7,1EPSS 0,47 % | ||
| CVE-2026-115355 Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers… |
Monitoruj |
CVSS 8,7EPSS 0,46 % | ||
| CVE-2026-115356 OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is… |
Pozostałe |
CVSS 5,3EPSS 0,21 % | ||
| CVE-2026-115357 OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request… |
Pozostałe |
CVSS 2,1EPSS 0,21 % | ||
| CVE-2026-115358 OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can… |
Pozostałe |
CVSS 2,0EPSS 0,19 % | ||
| CVE-2026-114655 libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into… |
Pozostałe |
CVSS 6,0EPSS 0,27 % | ||
| CVE-2026-115347 Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square… |
Monitoruj |
CVSS 8,7EPSS 0,41 % | ||
| CVE-2026-115348 Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU… |
Monitoruj |
CVSS 8,7EPSS 0,44 % | ||
| CVE-2026-115349 Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown… |
Monitoruj |
CVSS 8,7EPSS 0,34 % | ||
| CVE-2026-115350 Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens. Attackers who… |
Pozostałe |
CVSS 5,3EPSS 0,19 % | ||
| CVE-2026-115351 Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth… |
Pozostałe |
CVSS 5,3EPSS 0,22 % | ||
| CVE-2026-114651 A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted… |
Pozostałe |
CVSS 6,3EPSS 0,39 % | ||
| CVE-2026-114652 A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update… |
Monitoruj |
CVSS 7,1EPSS 0,3 % | ||
| CVE-2026-114653 A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression,… |
Monitoruj |
CVSS 7,1EPSS 0,21 % | ||
| CVE-2026-114654 A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the… |
Pozostałe |
CVSS 6,9EPSS 0,35 % | ||
| CVE-2026-114644 The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes… |
Monitoruj |
CVSS 8,2EPSS 0,48 % | ||
| CVE-2026-114645 A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential… |
Pozostałe |
CVSS 5,7EPSS 0,17 % | ||
| CVE-2026-114646 A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document object from externally… |
Pozostałe |
CVSS 6,9EPSS 0,26 % | ||
| CVE-2026-114647 The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that… |
Pozostałe |
CVSS 5,3EPSS 0,26 % | ||
| CVE-2026-114648 The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field… |
Monitoruj |
CVSS 7,2EPSS 0,32 % | ||
| CVE-2026-114649 The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates… |
Monitoruj |
CVSS 7,6EPSS 0,2 % | ||
| CVE-2026-114650 A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain… |
Pozostałe |
CVSS 6,9EPSS 0,11 % | ||
| CVE-2026-114519 Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company,… |
Monitoruj |
CVSS 8,6EPSS 0,36 % | ||
| CVE-2026-114612 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one… |
Wysoki priorytet |
CVSS 9,9EPSS 0,32 % | ||
| CVE-2026-114613 MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization… |
Monitoruj |
CVSS 7,5EPSS 0,54 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 8.11.2026, 16:02 UTC – 8.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.