KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.
The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against…
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read…
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACT_BUSINESS_TITLE_READ can…
1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through…
ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the…
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an…
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to…
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the…
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded…
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant. Low-privileged attackers can supply userId and tenantId parameters to reassign…
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via…
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource…
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit…
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to…
Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.
Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.
Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.
Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-106029 The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated… |
Monitoruj |
CVSS 7,5EPSS 0,25 % | ||
| CVE-2026-103305 The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing… |
Monitoruj |
CVSS 8,8EPSS 0,17 % | ||
| CVE-2026-108708 Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks… |
Monitoruj |
CVSS 8,7EPSS 0,28 % | ||
| CVE-2026-108700 1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title… |
Monitoruj |
CVSS 7,1EPSS 0,24 % | ||
| CVE-2026-108692 1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks.… |
Monitoruj |
CVSS 7,1EPSS 0,24 % | ||
| CVE-2026-108693 ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is… |
MonitorujPubliczny PoC |
CVSS 7,8EPSS 0,13 % | ||
| CVE-2026-108694 ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the… |
Monitoruj |
CVSS 7,1EPSS 0,26 % | ||
| CVE-2026-108695 MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST… |
Monitoruj |
CVSS 7,1EPSS 0,27 % | ||
| CVE-2026-108677 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password… |
Monitoruj |
CVSS 7,1EPSS 0,23 % | ||
| CVE-2026-108671 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is… |
Monitoruj |
CVSS 7,1EPSS 0,28 % | ||
| CVE-2026-108661 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant.… |
Monitoruj |
CVSS 7,1EPSS 0,21 % | ||
| CVE-2026-108657 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator… |
Monitoruj |
CVSS 8,6EPSS 0,23 % | ||
| CVE-2026-108648 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role… |
Monitoruj |
CVSS 7,1EPSS 0,29 % | ||
| CVE-2026-108628 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify… |
Monitoruj |
CVSS 8,6EPSS 0,23 % | ||
| CVE-2026-108623 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries.… |
Monitoruj |
CVSS 7,1EPSS 0,3 % | ||
| CVE-2026-78534 Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions. |
Monitoruj |
CVSS 7,1EPSS 0,15 % | ||
| CVE-2026-66566 Unauthenticated Local File Inclusion in Ambient <= 1.7 versions. |
Monitoruj |
CVSS 8,1EPSS 0,28 % | ||
| CVE-2026-78530 Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions. |
Monitoruj |
CVSS 7,7EPSS 0,4 % | ||
| CVE-2026-78532 Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions. |
Monitoruj |
CVSS 7,1EPSS 0,15 % | ||
| CVE-2026-65459 Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions. |
Monitoruj |
CVSS 7,5EPSS 0,24 % | ||
| CVE-2026-62117 Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions. |
Monitoruj |
CVSS 8,5EPSS 0,28 % | ||
| CVE-2026-62118 Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions. |
Monitoruj |
CVSS 7,3EPSS 0,22 % | ||
| CVE-2026-62130 Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions. |
Monitoruj |
CVSS 7,2EPSS 0,3 % | ||
| CVE-2026-62094 Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions. |
Monitoruj |
CVSS 8,1EPSS 0,28 % | ||
| CVE-2026-62095 Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions. |
Monitoruj |
CVSS 7,1EPSS 0,18 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 7.11.2026, 15:02 UTC – 7.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.