Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.get(String taskId) returns the…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it.…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,54 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,53 % · rekomendacja wg zapisanej polityki
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML containing…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and 15.1.1.0.0. Easily exploitable vulnerability allows…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus.…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Router. Successful attacks of…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon.…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
CVSS
7,5
EPSS
0,41 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.get(String taskId) returns the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,54 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,53 % · rekomendacja wg zapisanej polityki
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML containing…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and 15.1.1.0.0. Easily exploitable vulnerability allows…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Router. Successful attacks of…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
7,5
0,41 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.