KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27.
Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass. This issue affects Trex MES: through 2026-09-29.
AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware.…
OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes.
LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group to…
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an…
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.
Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.
Wstrzyknięcie SQL w Event Tickets umożliwia przeprowadzenie ataku typu Blind SQL Injection.
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.
Contributor Path Traversal in Creator LMS <= 1.2.19 versions.
Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.
Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.
Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.
Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.
Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-62097 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This… |
Monitoruj |
CVSS 7,6EPSS 0,23 % | ||
| CVE-2026-18783 Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass. This issue affects Trex MES: through… |
Monitoruj |
CVSS 8,8EPSS 0,35 % | ||
| CVE-2026-47097 AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static… |
Monitoruj |
CVSS 8,7EPSS 0,38 % | ||
| CVE-2026-103398 OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save… |
Monitoruj |
CVSS 8,6EPSS 0,27 % | ||
| CVE-2026-103270 LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like… |
Monitoruj |
CVSS 8,7EPSS 0,51 % | ||
| CVE-2026-102984 Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid.… |
Monitoruj |
CVSS 8,2EPSS 0,36 % | ||
| CVE-2026-102717 MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash |
Monitoruj |
CVSS 7,5EPSS 0,26 % | ||
| CVE-2026-101295 Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path… |
Monitoruj |
CVSS 7,3EPSS 0,15 % | ||
| CVE-2026-97289 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue… |
Monitoruj |
CVSS 7,1EPSS 0,14 % | ||
| CVE-2026-97293 Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions. |
Monitoruj |
CVSS 8,5EPSS 0,24 % | ||
| CVE-2026-97271 Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. |
Monitoruj |
CVSS 7,1EPSS 0,14 % | ||
| CVE-2026-97272 Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions. |
Monitoruj |
CVSS 7,1EPSS 0,14 % | ||
| CVE-2026-97287 Wstrzyknięcie SQL w Event Tickets umożliwia przeprowadzenie ataku typu Blind SQL Injection. |
Monitoruj |
CVSS 8,5EPSS 0,25 % | ||
| CVE-2026-97250 Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. |
Monitoruj |
CVSS 7,1EPSS 0,14 % | ||
| CVE-2026-97253 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a… |
Monitoruj |
CVSS 7,1EPSS 0,14 % | ||
| CVE-2026-97244 Contributor Path Traversal in Creator LMS <= 1.2.19 versions. |
Monitoruj |
CVSS 7,5EPSS 0,29 % | ||
| CVE-2026-97245 Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions. |
Monitoruj |
CVSS 7,2EPSS 0,33 % | ||
| CVE-2026-97235 Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. |
Monitoruj |
CVSS 7,1EPSS 0,18 % | ||
| CVE-2026-97237 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine:… |
Monitoruj |
CVSS 7,1EPSS 0,18 % | ||
| CVE-2026-97240 Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions. |
Monitoruj |
CVSS 7,5EPSS 0,29 % | ||
| CVE-2026-97241 Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions. |
Monitoruj |
CVSS 7,5EPSS 0,29 % | ||
| CVE-2026-97077 Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions. |
Monitoruj |
CVSS 7,1EPSS 0,19 % | ||
| CVE-2026-97197 Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions. |
Monitoruj |
CVSS 7,5EPSS 0,29 % | ||
| CVE-2026-96832 Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions. |
Monitoruj |
CVSS 7,2EPSS 0,36 % | ||
| CVE-2026-96833 Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions. |
Monitoruj |
CVSS 7,2EPSS 0,39 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 23:02 UTC – 13.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.