KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Riode Core riode-core allows Blind SQL Injection.This issue affects Riode Core: from n/a through <= 1.6.26.
Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5.
Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Lendiz lendiz allows Upload a Web Shell to a Web Server.This issue affects Lendiz: from n/a through < 2.0.1.
Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Keenarch keenarch allows Using Malicious Files.This issue affects Keenarch: from n/a through < 2.0.1.
Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors. Data::Rand::Obscure uses Perl's…
UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library. UnQLite for Perl embeds the UnQLite library. Version 0.06 and earlier of the Perl module uses a version of the library from 2014 that may be vulnerable to a…
Wersje Compress::Raw::Zlib do 2.219 używają potencjalnie niebezpiecznych wersji zlib, co może prowadzić do poważnych luk w bezpieczeństwie.
Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set…
Niebezpieczne generowanie identyfikatorów sesji w Apache::Session::Generate::MD5 umożliwia atakującym przejęcie sesji.
An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a Pingora proxy reads a request containing an Upgrade header, causing the proxy to pass through the rest of the bytes on…
An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple…
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed…
Wprowadzenie złośliwego kodu w aplikacji Files Open OnDemand przed wersjami 4.0.9 i 4.1.3 może prowadzić do nieautoryzowanego dostępu do danych.
Obejście uwierzytelnienia w pac4j-jwt pozwala na fałszowanie tokenów przez zdalnych atakujących.
Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the landing_location parameter. Attackers can send POST requests to the searched endpoint with…
Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the employerid parameter. Attackers can send POST requests to the register-recruiters endpoint with…
Simple Job Script contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting malicious SQL code through the app_id parameter. Attackers can send POST requests to delete_application_ajax.php with crafted payloads…
Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully…
2N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to remain active after logout in web application.
Brak uwierzytelnienia w Apache Artemis umożliwia atakującemu zdalne nawiązanie połączenia z brokerem, co prowadzi do wstrzykiwania lub kradzieży…
SEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution.
The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101 is vulnerable to OS Command Injection. The application insecurely parses…
An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101. An authenticated attacker can inject…
Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management Interface version 101 allows for XML Injection. The application…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2025-69338 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Riode Core riode-core allows Blind SQL Injection.This issue affects Riode… |
Wysoki priorytet |
CVSS 9,3EPSS 0,45 % | ||
| CVE-2025-54001 Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5. |
Wysoki priorytet |
CVSS 9,8EPSS 0,61 % | ||
| CVE-2025-68553 Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Lendiz lendiz allows Upload a Web Shell to a Web Server.This issue affects Lendiz: from n/a through < 2.0.1. |
Wysoki priorytet |
CVSS 9,9EPSS 0,52 % | ||
| CVE-2025-68554 Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Keenarch keenarch allows Using Malicious Files.This issue affects Keenarch: from n/a through < 2.0.1. |
Wysoki priorytet |
CVSS 9,9EPSS 0,5 % | ||
| CVE-2024-57854 Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a… |
Wysoki priorytet |
CVSS 9,1EPSS 0,45 % | ||
| CVE-2026-3257 UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library. UnQLite for Perl embeds the UnQLite library. Version 0.06 and earlier of the Perl… |
Wysoki priorytet |
CVSS 9,8EPSS 0,46 % | ||
| CVE-2026-3381 Wersje Compress::Raw::Zlib do 2.219 używają potencjalnie niebezpiecznych wersji zlib, co może prowadzić do poważnych luk w bezpieczeństwie. |
Wysoki priorytet |
CVSS 9,8EPSS 0,62 % | ||
| CVE-2025-40926 Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand… |
Wysoki priorytet |
CVSS 9,8EPSS 0,5 % | ||
| CVE-2025-40931 Niebezpieczne generowanie identyfikatorów sesji w Apache::Session::Generate::MD5 umożliwia atakującym przejęcie sesji. |
Wysoki priorytet |
CVSS 9,1EPSS 0,64 % | ||
| CVE-2026-2833 An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a Pingora proxy reads a request containing an… |
Wysoki priorytet |
CVSS 9,1EPSS 0,67 % | ||
| CVE-2026-2835 An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0… |
Wysoki priorytet |
CVSS 9,1EPSS 0,79 % | ||
| CVE-2026-29045 Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g.… |
Wysoki priorytet |
CVSS 9,8EPSS 0,59 % | ||
| CVE-2026-26002 Wprowadzenie złośliwego kodu w aplikacji Files Open OnDemand przed wersjami 4.0.9 i 4.1.3 może prowadzić do nieautoryzowanego dostępu do danych. |
Wysoki priorytet |
CVSS 9,8EPSS 0,61 % | ||
| CVE-2026-29000 Obejście uwierzytelnienia w pac4j-jwt pozwala na fałszowanie tokenów przez zdalnych atakujących. |
Wysoki priorytet |
CVSS 9,3EPSS 6,17 % | ||
| CVE-2026-3545 Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium… |
Wysoki priorytet |
CVSS 9,6EPSS 0,41 % | ||
| CVE-2019-25498 Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the landing_location parameter.… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,42 % | ||
| CVE-2019-25500 Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the employerid parameter.… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,33 % | ||
| CVE-2019-25501 Simple Job Script contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting malicious SQL code through the app_id parameter. Attackers can… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,39 % | ||
| CVE-2026-28783 Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via… |
Wysoki priorytet |
CVSS 9,1EPSS 0,51 % | ||
| CVE-2025-59786 2N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to remain active after logout in web application. |
Wysoki priorytet |
CVSS 9,8EPSS 0,29 % | ||
| CVE-2026-27446 Brak uwierzytelnienia w Apache Artemis umożliwia atakującemu zdalne nawiązanie połączenia z brokerem, co prowadzi do wstrzykiwania lub kradzieży… |
Wysoki priorytet |
CVSS 9,8EPSS 11,4 % | ||
| CVE-2026-27441 SEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution. |
Wysoki priorytet |
CVSS 9,8EPSS 0,34 % | ||
| CVE-2026-28773 The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101 is… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 2,37 % | ||
| CVE-2026-28774 An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 2,76 % | ||
| CVE-2026-28770 Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,42 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 03:02 UTC – 13.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.