KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wstawienie wrażliwych informacji do wysyłanych danych w bPlugins B Accordion umożliwia ich odzyskanie.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise WebCenter Content: Imaging.…
Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM…
Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.
Błąd kontroli dostępu w Groundhogg umożliwia nieautoryzowany dostęp do subskrybentów.
Błąd kontroli dostępu w rtMedia dla WordPressa umożliwia nieautoryzowany dostęp do zasobów.
W Craft użytkownicy mogą ujawniać wrażliwe zasoby przez zdjęcie profilowe.
Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not…
Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format…
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2…
Missing authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially spoof address bar via a crafted HTML page. (Chromium security severity: Low)
Odczyt poza zakresem w ANGLE w Google Chrome umożliwia zdalnemu atakującemu pozyskanie danych.
Odczyt poza zakresem w ANGLE w Google Chrome umożliwia zdalnemu atakującemu pozyskanie danych.
Nieprawidłowa implementacja w MediaCapture w Google Chrome umożliwia oszustwo UI przez złośliwą stronę.
Nieodpowiednia implementacja w Media w Google Chrome umożliwia oszustwo UI przez złośliwą stronę.
Wtyczka WP Project Manager dla WordPressa ma podatność na wstrzyknięcie SQL, co pozwala na wyciek danych.
OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTP_HOST and…
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal…
Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's is_active field, including deactivating a project…
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML…
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password.
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level…
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in radio range may be able to cause unexpected…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wstawienie wrażliwych informacji do wysyłanych danych w bPlugins B Accordion umożliwia ich odzyskanie. | Wstawienie wrażliwych informacji do wysyłanych danych w bPlugins B Accordion umożliwia ich odzyskanie. |
Do wiadomości | 6,5 | 0,28 % | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows… | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0. |
Do wiadomości | 6,5 | 0,28 % | ||
| Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). | Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise WebCenter Content: Imaging.… |
Do wiadomości | 6,5 | 0,28 % | ||
| Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions. | Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions. |
Do wiadomości | 6,5 | 0,28 % | ||
| Banks generates meaningful LLM prompts using a simple template language. | Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM… |
Do wiadomości | 6,5 | 0,28 % | ||
| Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions. | Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions. |
Do wiadomości | 6,5 | 0,28 % | ||
| Błąd kontroli dostępu w Groundhogg umożliwia nieautoryzowany dostęp do subskrybentów. | Błąd kontroli dostępu w Groundhogg umożliwia nieautoryzowany dostęp do subskrybentów. |
Do wiadomości | 6,5 | 0,28 % | ||
| Błąd kontroli dostępu w rtMedia dla WordPressa umożliwia nieautoryzowany dostęp do zasobów. | Błąd kontroli dostępu w rtMedia dla WordPressa umożliwia nieautoryzowany dostęp do zasobów. |
Do wiadomości | 6,5 | 0,28 % | ||
| W Craft użytkownicy mogą ujawniać wrażliwe zasoby przez zdjęcie profilowe. | W Craft użytkownicy mogą ujawniać wrażliwe zasoby przez zdjęcie profilowe. |
Do wiadomości | 6,5 | 0,28 % | ||
| Tuleap is an Open Source Suite for management of software development and collaboration. | Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not… |
Do wiadomości | 6,5 | 0,28 % | ||
| Improper Input Validation vulnerability in Apache Camel Mail component. | Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format… |
Do wiadomości | 6,5 | 0,28 % | ||
| RabbitMQ is a messaging and streaming broker. | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2… |
Do wiadomości | 6,5 | 0,28 % | ||
| Missing authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process… | Missing authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially spoof address bar via a crafted HTML page. (Chromium security severity: Low) |
Do wiadomości | 6,5 | 0,28 % | ||
| Odczyt poza zakresem w ANGLE w Google Chrome umożliwia zdalnemu atakującemu pozyskanie danych. | Odczyt poza zakresem w ANGLE w Google Chrome umożliwia zdalnemu atakującemu pozyskanie danych. |
Do wiadomości | 6,5 | 0,28 % | ||
| Odczyt poza zakresem w ANGLE w Google Chrome umożliwia zdalnemu atakującemu pozyskanie danych. | Odczyt poza zakresem w ANGLE w Google Chrome umożliwia zdalnemu atakującemu pozyskanie danych. |
Do wiadomości | 6,5 | 0,28 % | ||
| Nieprawidłowa implementacja w MediaCapture w Google Chrome umożliwia oszustwo UI przez złośliwą stronę. | Nieprawidłowa implementacja w MediaCapture w Google Chrome umożliwia oszustwo UI przez złośliwą stronę. |
Do wiadomości | 6,5 | 0,28 % | ||
| Nieodpowiednia implementacja w Media w Google Chrome umożliwia oszustwo UI przez złośliwą stronę. | Nieodpowiednia implementacja w Media w Google Chrome umożliwia oszustwo UI przez złośliwą stronę. |
Do wiadomości | 6,5 | 0,28 % | ||
| Wtyczka WP Project Manager dla WordPressa ma podatność na wstrzyknięcie SQL, co pozwala na wyciek danych. | Wtyczka WP Project Manager dla WordPressa ma podatność na wstrzyknięcie SQL, co pozwala na wyciek danych. |
Do wiadomości | 6,5 | 0,28 % | ||
| OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to… | OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTP_HOST and… |
Do wiadomości | 6,5 | 0,28 % | ||
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before… | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal… |
Do wiadomości | 6,5 | 0,28 % | ||
| Plane is an open-source project management tool. | Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's is_active field, including deactivating a project… |
Do wiadomości | 6,5 | 0,28 % | ||
| Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML… |
Do wiadomości | 6,5 | 0,28 % | ||
| IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior… | IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password. |
Do wiadomości | 6,5 | 0,28 % | ||
| The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.15. | The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level… |
Do wiadomości | 6,5 | 0,28 % | ||
| An out-of-bounds write issue was addressed with improved bounds checking. | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in radio range may be able to cause unexpected… |
Do wiadomości | 6,5 | 0,28 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.