KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is…
User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in…
A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of…
A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue…
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an…
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: * 7.0.X * 8.0.X *…
The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed…
A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects the function mysql_query of the file source/adminregister.php of the component Registration Handler. Performing a manipulation…
A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the…
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via…
The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone…
A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack…
A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file source/loginprocessing.php of the component Login Handler. This manipulation…
A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/authprocessing.php of the component Forgot Password Handler. Such…
The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management…
A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete…
An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission,…
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all…
A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site…
Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.
Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.
Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information.
Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.
Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.
Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-78359 OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are… |
Pozostałe |
CVSS 5,4EPSS 0,16 % | ||
| CVE-2026-93581 User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received… |
Pozostałe |
CVSS 6,1EPSS 0,19 % | ||
| CVE-2026-108809 A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout.… |
Pozostałe |
CVSS 2,0EPSS 0,18 % | ||
| CVE-2026-109082 A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication… |
Pozostałe |
CVSS 6,8EPSS 0,25 % | ||
| CVE-2026-48211 An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS… |
Pozostałe |
CVSS 5,4EPSS 0,12 % | ||
| CVE-2026-48212 An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing… |
Pozostałe |
CVSS 4,8EPSS 0,14 % | ||
| CVE-2026-78356 The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is… |
Pozostałe |
CVSS 5,3EPSS 0,28 % | ||
| CVE-2026-108807 A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects the function mysql_query of the file source/adminregister.php… |
Pozostałe |
CVSS 5,5EPSS 0,25 % | ||
| CVE-2026-108808 A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of… |
Pozostałe |
CVSS 1,2EPSS 0,18 % | ||
| CVE-2026-84166 The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into… |
Pozostałe |
CVSS 4,3EPSS 0,1 % | ||
| CVE-2026-84167 The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other… |
Pozostałe |
CVSS 4,3EPSS 0,17 % | ||
| CVE-2026-108803 A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The… |
Pozostałe |
CVSS 5,3EPSS 0,2 % | ||
| CVE-2026-108805 A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file… |
Pozostałe |
CVSS 5,5EPSS 0,25 % | ||
| CVE-2026-108806 A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file… |
Pozostałe |
CVSS 5,5EPSS 0,25 % | ||
| CVE-2025-15703 The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users… |
Pozostałe |
CVSS 3,5EPSS 0,15 % | ||
| CVE-2026-107193 A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A… |
Pozostałe |
CVSS 6,5EPSS 0,18 % | ||
| CVE-2026-107203 An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package. The domain and subnet interface API checks only that the caller holds a… |
Pozostałe |
CVSS 5,4EPSS 0,15 % | ||
| CVE-2026-107791 The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with… |
Pozostałe |
CVSS 6,5EPSS 0,18 % | ||
| CVE-2026-108802 A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview.… |
Pozostałe |
CVSS 2,0EPSS 0,2 % | ||
| CVE-2026-21133 Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data. |
Pozostałe |
CVSS 5,1EPSS 0,14 % | ||
| CVE-2026-21134 Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information. |
Pozostałe |
CVSS 6,1EPSS 0,19 % | ||
| CVE-2026-21135 Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information. |
Pozostałe |
CVSS 5,9EPSS 0,11 % | ||
| CVE-2026-21136 Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process. |
Pozostałe |
CVSS 6,8EPSS 0,14 % | ||
| CVE-2026-21137 Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege. |
Pozostałe |
CVSS 5,1EPSS 0,17 % | ||
| CVE-2026-21138 Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications. |
Pozostałe |
CVSS 6,9EPSS 0,1 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 10.11.2026, 07:32 UTC – 10.11.2026, 09:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.