Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,69 % · rekomendacja wg zapisanej polityki
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Do not add the same hwpt to the ioas->hwpt_list twice
The hwpt is added to the hwpt_list only during its creation, it is never
added again. This hunk is some missed leftover from rework. Adding it
twice will corrupt the…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,68 % · rekomendacja wg zapisanej polityki
The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)
that scans container processes for runtime fingerprinting. When scanning a
container, the coordinator:
1. **fork()s** a child process
2. **setns()** into the target container's PID and mount namespaces
3. **fchdir()**…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack,…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,68 % · rekomendacja wg zapisanej polityki
AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, `anki_mcp_server/mcp_server.py` globally disables FastMCP DNS-rebinding protection through `TransportSecuritySettings` with…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer. Attackers can supply incompressible data that exceeds the destination buffer's remaining capacity, corrupting off-heap memory and…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,68 % · rekomendacja wg zapisanej polityki
XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain
other grant table operations. Sadly a v2 -> v1 -> v2 change has yet
another effect which wasn't accounted for: During the first change, status
pages would be freed. During the second change they would be allocated
again.…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Remote…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,69 % · rekomendacja wg zapisanej polityki
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Do not add the same hwpt to the ioas->hwpt_list twice
The hwpt is added to the hwpt_list only during its creation, it is never
added again. This hunk is some missed leftover from rework. Adding it
twice will corrupt the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,68 % · rekomendacja wg zapisanej polityki
The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)
that scans container processes for runtime fingerprinting. When scanning a
container, the coordinator:
1. **fork()s** a child process
2. **setns()** into the target container's PID and mount namespaces
3. **fchdir()**…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,68 % · rekomendacja wg zapisanej polityki
AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, `anki_mcp_server/mcp_server.py` globally disables FastMCP DNS-rebinding protection through `TransportSecuritySettings` with…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer. Attackers can supply incompressible data that exceeds the destination buffer's remaining capacity, corrupting off-heap memory and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,68 % · rekomendacja wg zapisanej polityki
XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain
other grant table operations. Sadly a v2 -> v1 -> v2 change has yet
another effect which wasn't accounted for: During the first change, status
pages would be freed. During the second change they would be allocated
again.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Remote…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki