KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the…
Wtyczka Simply Schedule Appointments w WordPress umożliwia ujawnienie danych osobowych klientów.
Nieprawidłowa inicjalizacja w niektórych płytach głównych ASUS pozwala na odczyt i zapis pamięci przez fizycznego użytkownika.
Luka w kodzie debugowania w routerach ASUS pozwala zdalnemu użytkownikowi na wykonanie dowolnych poleceń.
Nieautoryzowane odczyty plików w DeepWiki-Open umożliwiają atakującym dostęp do dowolnych plików.
Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast…
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.
Podatność na przejście ścieżki w modelscope Agentscope umożliwia nieautoryzowany dostęp do plików.
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. The save_file_b64 method accepts user-controlled file paths without normalization or validation, allowing path traversal…
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the…
modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.
W pypdf przed wersją 6.18.1 złośliwy PDF może powodować długie czasy przetwarzania i niedostępność aplikacji.
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an…
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup,…
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length when an application…
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and retain oversized values…
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond…
A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed…
An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code…
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to…
An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read…
An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision a platform account for an identity it did not already know. A remote,…
A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full…
Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-76146 An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely |
Monitoruj |
CVSS 8,4EPSS 1,93 % | ||
| CVE-2026-96561 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a… |
Monitoruj |
CVSS 7,2EPSS 0,33 % | ||
| CVE-2026-92245 Wtyczka Simply Schedule Appointments w WordPress umożliwia ujawnienie danych osobowych klientów. |
Monitoruj |
CVSS 7,5EPSS 0,43 % | ||
| CVE-2026-93495 Nieprawidłowa inicjalizacja w niektórych płytach głównych ASUS pozwala na odczyt i zapis pamięci przez fizycznego użytkownika. |
Monitoruj |
CVSS 7,0EPSS 0,16 % | ||
| CVE-2026-13313 Luka w kodzie debugowania w routerach ASUS pozwala zdalnemu użytkownikowi na wykonanie dowolnych poleceń. |
Monitoruj |
CVSS 8,9EPSS 0,68 % | ||
| CVE-2026-103591 Nieautoryzowane odczyty plików w DeepWiki-Open umożliwiają atakującym dostęp do dowolnych plików. |
Monitoruj |
CVSS 8,7EPSS 0,43 % | ||
| CVE-2026-92172 Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application… |
Monitoruj |
CVSS 8,8EPSS 0,29 % | ||
| CVE-2026-51860 bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py. |
Monitoruj |
CVSS 7,5EPSS 0,7 % | ||
| CVE-2026-51570 Podatność na przejście ścieżki w modelscope Agentscope umożliwia nieautoryzowany dostęp do plików. |
Monitoruj |
CVSS 8,1EPSS 0,3 % | ||
| CVE-2026-51852 agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. The save_file_b64 method accepts user-controlled file… |
Monitoruj |
CVSS 7,5EPSS 0,77 % | ||
| CVE-2026-51853 agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializes with the host root… |
Monitoruj |
CVSS 7,5EPSS 0,77 % | ||
| CVE-2026-51568 modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file. |
Monitoruj |
CVSS 8,1EPSS 0,39 % | ||
| CVE-2026-102997 W pypdf przed wersją 6.18.1 złośliwy PDF może powodować długie czasy przetwarzania i niedostępność aplikacji. |
Monitoruj |
CVSS 7,5EPSS 0,34 % | ||
| CVE-2026-102998 pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to… |
Monitoruj |
CVSS 7,5EPSS 0,34 % | ||
| CVE-2026-102999 pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in… |
Monitoruj |
CVSS 7,5EPSS 0,35 % | ||
| CVE-2026-103000 pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to… |
Monitoruj |
CVSS 7,5EPSS 0,35 % | ||
| CVE-2026-102995 pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping,… |
Monitoruj |
CVSS 7,5EPSS 0,34 % | ||
| CVE-2026-102996 pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing… |
Monitoruj |
CVSS 7,5EPSS 0,34 % | ||
| CVE-2026-102142 A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System… |
Monitoruj |
CVSS 7,2EPSS 1,2 % | ||
| CVE-2026-102143 An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly… |
Monitoruj |
CVSS 7,5EPSS 0,32 % | ||
| CVE-2026-102150 A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal… |
Monitoruj |
CVSS 7,2EPSS 0,25 % | ||
| CVE-2026-102127 An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and… |
Monitoruj |
CVSS 7,0EPSS 0,19 % | ||
| CVE-2026-102128 An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision… |
Monitoruj |
CVSS 7,5EPSS 0,21 % | ||
| CVE-2026-102129 A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions… |
Monitoruj |
CVSS 7,2EPSS 0,84 % | ||
| CVE-2026-102130 Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An… |
Monitoruj |
CVSS 7,2EPSS 1,19 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 07:02 UTC – 12.11.2026, 12:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.