KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.
Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions…
Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights…
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to…
Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login…
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop…
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of…
Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send…
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An…
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-84913 Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1. |
Pozostałe |
CVSS 4,6EPSS 0,19 % | ||
| CVE-2026-84914 Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3. |
Pozostałe |
CVSS 5,3EPSS 0,27 % | ||
| CVE-2026-84915 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks… |
Pozostałe |
CVSS 4,6EPSS 0,21 % | ||
| CVE-2026-114722 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer… |
Pozostałe |
CVSS 6,5EPSS 0,25 % | ||
| CVE-2026-114723 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the… |
Pozostałe |
CVSS 5,3EPSS 0,33 % | ||
| CVE-2026-114724 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no… |
Monitoruj |
CVSS 8,1EPSS 0,41 % | ||
| CVE-2026-114725 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and… |
Pozostałe |
CVSS 5,0EPSS 0,33 % | ||
| CVE-2026-114726 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip… |
Pozostałe |
CVSS 5,8EPSS 0,4 % | ||
| CVE-2026-114727 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact… |
Monitoruj |
CVSS 8,3EPSS 0,33 % | ||
| CVE-2026-114728 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token… |
Pozostałe |
CVSS 5,3EPSS 0,37 % | ||
| CVE-2026-114716 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an… |
Monitoruj |
CVSS 8,5EPSS 0,44 % | ||
| CVE-2026-114717 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded… |
Pozostałe |
CVSS 5,8EPSS 0,45 % | ||
| CVE-2026-114718 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated… |
Pozostałe |
CVSS 6,1EPSS 0,29 % | ||
| CVE-2026-114719 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from… |
Pozostałe |
CVSS 4,3EPSS 0,22 % | ||
| CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected… |
Monitoruj |
CVSS 7,1EPSS 0,79 % | ||
| CVE-2026-114721 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote… |
Pozostałe |
CVSS 3,1EPSS 0,3 % | ||
| CVE-2026-114660 Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via… |
Monitoruj |
CVSS 7,0EPSS 0,21 % | ||
| CVE-2026-114661 OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without… |
Wysoki priorytet |
CVSS 9,0EPSS 0,35 % | ||
| CVE-2026-114662 Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers… |
Monitoruj |
CVSS 8,6EPSS 0,17 % | ||
| CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope… |
Monitoruj |
CVSS 8,6EPSS 0,18 % | ||
| CVE-2026-114664 Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied… |
Monitoruj |
CVSS 7,1EPSS 0,2 % | ||
| CVE-2026-114715 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry… |
Monitoruj |
CVSS 8,1EPSS 0,34 % | ||
| CVE-2026-114641 Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is… |
Pozostałe |
CVSS 6,3EPSS 0,26 % | ||
| CVE-2026-114642 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client… |
Monitoruj |
CVSS 7,0EPSS 0,19 % | ||
| CVE-2026-114656 Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are… |
Wysoki priorytet |
CVSS 9,3EPSS 0,15 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 9.11.2026, 04:02 UTC – 9.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.