Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Mindio Magic MCP | CVE-2026-104402 Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6. |
4,3 | 0,18 % | Brak wpisu w KEV nie wyklucza ataków | |
| zitadel | CVE-2026-105214 Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register… |
2,3 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| DocSys | CVE-2026-105158 A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.createDBForMysql of the file BaseController.java of the component Database Management. The manipulation of the argument url results in sql injection. The attack can be executed… |
5,5 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| siyuan | CVE-2026-105205 SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo… |
6,9 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| zitadel | CVE-2026-105206 ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET… |
5,3 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| YzmCMS | CVE-2026-105156 A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be… |
2,9 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| DocSys | CVE-2026-105157 A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do of the component Document Controller. The manipulation of the argument path/fileName leads to path traversal. Remote… |
2,1 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| R2R | CVE-2026-105148 A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component Retrieval Completion API Endpoint. Such manipulation of the argument generation_config.api_base leads to server-side request forgery. The… |
5,5 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| mooSocial | CVE-2026-105149 A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. Performing a manipulation of the argument rating results in sql injection. The attack may be initiated remotely. The exploit has been released to the public… |
5,5 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| R2R | CVE-2026-105147 A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has… |
5,5 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| Discuz! | CVE-2026-105146 A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the function modmedalsubmit of the file upload/source/app/admin/child/medals/mod.php of the component Admin Medal Moderation. The manipulation of the argument delete results in sql… |
2,0 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| Verba | CVE-2026-105145 A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function get_environment of the file goldenverba/components/util.py of the component generate_stream Endpoint. The manipulation leads to information disclosure. It is possible to initiate the attack… |
5,5 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| cognee | CVE-2026-105141 A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get_user_id_by_email of the file cognee/modules/users/authentication/get_api_auth_backend.py of the component JWT Signing Key Handler. The manipulation of the argument… |
5,3 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| Drogon | CVE-2026-105144 A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file lib/src/StaticFileRouter.cc of the component Static File Router. Executing a manipulation can lead to path traversal. The attack may be performed from remote. The… |
5,5 | 0,55 % | Brak wpisu w KEV nie wyklucza ataków | |
| Laradock | CVE-2026-105137 A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without integrity check. The attack can be launched remotely. A high complexity level is associated with… |
1,3 | 0,16 % | Brak wpisu w KEV nie wyklucza ataków | |
| Five Star Business Profile and Schema | CVE-2026-86817 The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users'… |
4,9 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| User Private Files | CVE-2026-97332 The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private… |
5,3 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| Horizontal scrolling announcements | CVE-2026-17005 The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once… |
6,8 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| Simple Shopping Cart | CVE-2026-104119 The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite… |
3,5 | 0,14 % | Brak wpisu w KEV nie wyklucza ataków | |
| Razorpay for WooCommerce | CVE-2026-104118 The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders. |
5,3 | 0,18 % | Brak wpisu w KEV nie wyklucza ataków | |
| CoinEx Crypto | CVE-2026-105099 A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the component Ticket Attachment Upload. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The… |
2,0 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| CoinEx Crypto | CVE-2026-105098 A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. Affected is an unknown function of the file /ticket/customer of the component Support Ticket API. The manipulation of the argument status/page/count results in information disclosure. The attack can be executed remotely. The… |
2,1 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| CoinEx Crypto | CVE-2026-105097 A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The… |
2,1 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| ezBookkeeping | CVE-2026-105131 ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API… |
5,3 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| CoinEx Crypto | CVE-2026-105096 A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Executing a manipulation of the argument ID can lead to authorization bypass. The attack may be launched remotely. The exploit has… |
2,1 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 14.11.2026, 15:02 UTC – 14.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.