KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
OpenClaw versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that allow attackers to fetch attacker-controlled remote URLs without SSRF protections via sendMediaFeishu function and markdown image…
OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory. Attackers can craft malicious archives with traversal sequences like ../../ to…
OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to the webhook endpoint that trust attacker-controlled JSON payloads. Remote attackers can forge…
Nieprawidłowe powiązanie sieci w OpenClaw umożliwia zdalne ataki na serwer relay.
OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allowing attackers to bypass command approval restrictions. Remote attackers can craft command strings…
OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sender when dmPolicy is set to open (must be configured). Attackers can execute privileged…
OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execution. The hooks.mappings[].transform.module parameter accepts absolute paths and traversal…
Brak wygasania tokenów resetujących hasło w HexPM umożliwia przejęcie konta przez atakującego, wykorzystującego stare linki z e-maili.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows…
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal system files or folders through the application interface. However, when interacting directly…
Chamilo is a learning management system. Versions prior to 1.11.34 have a Stored XSS through insecure file uploads in `Social Networks`. Through it, a low-privilege user can execute arbitrary code in the admin user inbox, allowing takeover of the admin…
Wstrzyknięcie nagłówka hosta w @perfood/couch-auth umożliwia przejęcie konta przez atakujących.
Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was distributed via OpenVSX marketplace was compromised and contained malicious code designed to leverage local AI coding…
Podatność w D-Link DIR-1253 MESH V1.6.1684 umożliwia eskalację uprawnień poprzez manipulację plikiem etc/shadow.sample.
Niebezpieczne parsowanie konfiguracji OpenMQ pozwala zdalnemu atakującemu na odczytanie dowolnych plików.
Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacking extension diversity, allowing Deep Packet Inspection (DPI) systems to trivially identify and block proxy traffic,…
Brak autoryzacji w RustDesk Client umożliwia manipulację wiadomościami API przez atak typu Man-in-the-Middle.
Manipulacja wiadomościami API aplikacji w RustDesk Client umożliwia atak typu Man-in-the-Middle.
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'download_csv' function. This makes it possible for…
A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution.
Przepełnienie bufora w SeppMail umożliwia zdalne wykonanie kodu przez nieautoryzowane przesyłanie plików.
A Improper Access Control vulnerability in the kernel of SUSE SUSE Linux Enterprise Server 12 SP5 breaks nftables, causing firewall rules applied via nftables to not be effective.This issue affects SUSE Linux Enterprise Server: from…
The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauthenticated users to be authenticated as any user (such as admin) by simply knowing the email
Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Blind SQL Injection.This issue affects WP…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-28451 OpenClaw versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that allow attackers to fetch attacker-controlled remote URLs without SSRF… |
Wysoki priorytet |
CVSS 9,3EPSS 0,32 % | ||
| CVE-2026-28453 OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory. Attackers… |
Wysoki priorytet |
CVSS 9,8EPSS 0,48 % | ||
| CVE-2026-28454 OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to the webhook endpoint that… |
Wysoki priorytet |
CVSS 9,8EPSS 0,3 % | ||
| CVE-2026-28395 Nieprawidłowe powiązanie sieci w OpenClaw umożliwia zdalne ataki na serwer relay. |
Wysoki priorytet |
CVSS 9,1EPSS 0,46 % | ||
| CVE-2026-28391 OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allowing attackers to bypass… |
Wysoki priorytet |
CVSS 9,2EPSS 0,58 % | ||
| CVE-2026-28392 OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sender when dmPolicy is… |
Wysoki priorytet |
CVSS 9,8EPSS 0,4 % | ||
| CVE-2026-28393 OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execution. The… |
Wysoki priorytet |
CVSS 9,8EPSS 0,51 % | ||
| CVE-2026-21622 Brak wygasania tokenów resetujących hasło w HexPM umożliwia przejęcie konta przez atakującego, wykorzystującego stare linki z e-maili. |
Wysoki priorytet |
CVSS 9,8EPSS 0,44 % | ||
| CVE-2026-29188 File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access… |
Wysoki priorytetPubliczny PoC |
CVSS 8,1EPSS 0,54 % | ||
| CVE-2026-28442 ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal system files or folders… |
Wysoki priorytetPubliczny PoC |
CVSS 8,5EPSS 0,35 % | ||
| CVE-2025-55208 Chamilo is a learning management system. Versions prior to 1.11.34 have a Stored XSS through insecure file uploads in `Social Networks`. Through it, a low-privilege user can execute… |
Wysoki priorytet |
CVSS 9,0EPSS 0,36 % | ||
| CVE-2025-70948 Wstrzyknięcie nagłówka hosta w @perfood/couch-auth umożliwia przejęcie konta przez atakujących. |
Wysoki priorytet |
CVSS 9,3EPSS 0,4 % | ||
| CVE-2026-28353 Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was distributed via OpenVSX marketplace was compromised… |
Wysoki priorytet |
CVSS 10,0EPSS 0,51 % | ||
| CVE-2025-29165 Podatność w D-Link DIR-1253 MESH V1.6.1684 umożliwia eskalację uprawnień poprzez manipulację plikiem etc/shadow.sample. |
Wysoki priorytet |
CVSS 9,8EPSS 0,74 % | ||
| CVE-2026-24457 Niebezpieczne parsowanie konfiguracji OpenMQ pozwala zdalnemu atakującemu na odczytanie dowolnych plików. |
Wysoki priorytet |
CVSS 9,8EPSS 0,7 % | ||
| CVE-2025-13476 Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacking extension diversity, allowing Deep Packet… |
Wysoki priorytet |
CVSS 9,8EPSS 0,37 % | ||
| CVE-2026-30797 Brak autoryzacji w RustDesk Client umożliwia manipulację wiadomościami API przez atak typu Man-in-the-Middle. |
Wysoki priorytetPubliczny PoC |
CVSS 8,1EPSS 0,52 % | ||
| CVE-2026-30792 Manipulacja wiadomościami API aplikacji w RustDesk Client umożliwia atak typu Man-in-the-Middle. |
Wysoki priorytetPubliczny PoC |
CVSS 8,1EPSS 0,3 % | ||
| CVE-2026-2599 The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of… |
Wysoki priorytet |
CVSS 9,8EPSS 0,61 % | ||
| CVE-2026-21628 A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution. |
Wysoki priorytet |
CVSS 9,8EPSS 0,54 % | ||
| CVE-2026-2743 Przepełnienie bufora w SeppMail umożliwia zdalne wykonanie kodu przez nieautoryzowane przesyłanie plików. |
Wysoki priorytet |
CVSS 9,8EPSS 0,95 % | ||
| CVE-2026-25702 A Improper Access Control vulnerability in the kernel of SUSE SUSE Linux Enterprise Server 12 SP5 breaks nftables, causing firewall rules applied via nftables to not be effective.This… |
Wysoki priorytet |
CVSS 9,8EPSS 0,23 % | ||
| CVE-2026-2418 The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauthenticated users to be authenticated as any… |
Wysoki priorytet |
CVSS 9,1EPSS 0,35 % | ||
| CVE-2026-29053 Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has… |
Wysoki priorytet |
CVSS 9,8EPSS 4,9 % | ||
| CVE-2026-28115 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations… |
Wysoki priorytet |
CVSS 9,3EPSS 0,27 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 03:02 UTC – 13.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.