KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files from a remote source and execute them.
U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content.
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them.
A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the component Endpoint. Executing a manipulation can lead to xml external entity reference. The attack may…
A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code…
wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to…
Wstrzyknięcie SQL w openDCIM umożliwia uwierzytelnionemu użytkownikowi wykonanie dowolnych zapytań.
Brak autoryzacji w openDCIM umożliwia nieautoryzowaną modyfikację konfiguracji aplikacji.
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to…
Podatność w @fastify/middie < 9.2.0 pozwala na obejście uwierzytelnienia, co umożliwia dostęp do chronionych zasobów.
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing predictable MD5-based cookies. Attackers who know or guess valid…
CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using…
CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) uses the includes() method…
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative access to the management interface. Attackers can authenticate using the hardcoded default…
Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injecting SQL syntax into username and password fields. Attackers can submit SQL operators like '=' 'or'…
PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system and views…
Nieprawidłowa walidacja danych w Centreon Open Tickets pozwala na nieautoryzowany dostęp.
Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central Server…
Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated attacker to bypass authentication and gain administrative privileges. This issue was identified in version 1.2.0 of this…
Wstrzyknięcie SQL w Windesk.Fm umożliwia nieautoryzowany dostęp do bazy danych.
Wstrzyknięcie SQL w platformie e-commerce Dayneks umożliwia nieautoryzowany dostęp do danych.
Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full…
Twardo zakodowane dane logowania w Frick Controls Quantum HD umożliwiają nieautoryzowany dostęp.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit unexpected…
Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-3000 IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files… |
Wysoki priorytet |
CVSS 9,3EPSS 0,56 % | ||
| CVE-2026-3422 U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending… |
Wysoki priorytet |
CVSS 9,3EPSS 0,92 % | ||
| CVE-2026-2999 IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable… |
Wysoki priorytet |
CVSS 9,3EPSS 0,56 % | ||
| CVE-2026-3404 A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the component Endpoint. Executing a… |
Wysoki priorytetPubliczny PoC |
CVSS 8,1EPSS 0,4 % | ||
| CVE-2026-3395 A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp… |
Wysoki priorytet |
CVSS 9,8EPSS 4,02 % | ||
| CVE-2026-28562 wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted… |
Wysoki priorytet |
CVSS 9,8EPSS 0,48 % | ||
| CVE-2026-28516 Wstrzyknięcie SQL w openDCIM umożliwia uwierzytelnionemu użytkownikowi wykonanie dowolnych zapytań. |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 1,07 % | ||
| CVE-2026-28515 Brak autoryzacji w openDCIM umożliwia nieautoryzowaną modyfikację konfiguracji aplikacji. |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 1,28 % | ||
| CVE-2026-28268 Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that… |
Wysoki priorytet |
CVSS 9,8EPSS 0,74 % | ||
| CVE-2026-2880 Podatność w @fastify/middie < 9.2.0 pozwala na obejście uwierzytelnienia, co umożliwia dostęp do chronionych zasobów. |
Wysoki priorytet |
CVSS 9,1EPSS 0,43 % | ||
| CVE-2026-27755 SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing… |
Wysoki priorytet |
CVSS 9,3EPSS 0,46 % | ||
| CVE-2026-26861 CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in… |
Wysoki priorytetPubliczny PoC |
CVSS 8,3EPSS 0,21 % | ||
| CVE-2026-26862 CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in… |
Wysoki priorytetPubliczny PoC |
CVSS 8,3EPSS 0,42 % | ||
| CVE-2026-27751 SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative access to the management… |
Wysoki priorytet |
CVSS 9,3EPSS 0,51 % | ||
| CVE-2019-25494 Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injecting SQL syntax into username… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,46 % | ||
| CVE-2025-69437 PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user… |
Wysoki priorytetPubliczny PoC |
CVSS 8,7EPSS 0,4 % | ||
| CVE-2026-2750 Nieprawidłowa walidacja danych w Centreon Open Tickets pozwala na nieautoryzowany dostęp. |
Wysoki priorytet |
CVSS 9,8EPSS 0,34 % | ||
| CVE-2026-2751 Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows… |
Wysoki priorytet |
CVSS 9,8EPSS 0,31 % | ||
| CVE-2025-15498 Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated attacker to bypass authentication and gain… |
Wysoki priorytet |
CVSS 9,3EPSS 0,59 % | ||
| CVE-2025-11252 Wstrzyknięcie SQL w Windesk.Fm umożliwia nieautoryzowany dostęp do bazy danych. |
Wysoki priorytet |
CVSS 9,8EPSS 0,43 % | ||
| CVE-2025-11251 Wstrzyknięcie SQL w platformie e-commerce Dayneks umożliwia nieautoryzowany dostęp do danych. |
Wysoki priorytet |
CVSS 9,8EPSS 0,44 % | ||
| CVE-2026-21659 Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated… |
Wysoki priorytet |
CVSS 9,8EPSS 1,05 % | ||
| CVE-2026-21660 Twardo zakodowane dane logowania w Frick Controls Quantum HD umożliwiają nieautoryzowany dostęp. |
Wysoki priorytet |
CVSS 9,8EPSS 0,26 % | ||
| CVE-2026-21654 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command… |
Wysoki priorytet |
CVSS 9,8EPSS 1,66 % | ||
| CVE-2026-21656 Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain… |
Wysoki priorytet |
CVSS 9,8EPSS 0,45 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 07:02 UTC – 13.11.2026, 12:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.