Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Acronis Cyber Protect 16 / Acronis Cyber Protect 15 | CVE-2025-30416 Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800. |
10,0 | 0,45 % | Brak wpisu w KEV nie wyklucza ataków | |
| openclaw | CVE-2026-27002 OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access. OpenClaw 2026.2.15… |
9,8 | 0,53 % | Brak wpisu w KEV nie wyklucza ataków | |
| RustFly | CVE-2026-27476 RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism that accepts hex-encoded instructions over UDP port 5005 without proper sanitization. Attackers can send crafted hex-encoded payloads containing system commands to execute arbitrary operations on the target… |
9,3 | 2,99 % | Brak wpisu w KEV nie wyklucza ataków | |
| SillyTavern | CVE-2026-26286 SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.16.0, a Server-Side Request Forgery (SSRF) vulnerability in the asset download endpoint… |
8,5 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| systeminformation | CVE-2026-26318 Wstrzyknięcie poleceń w systeminformation umożliwia zdalne wykonanie kodu. |
8,8 | 1,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| SPIP | CVE-2026-27475 SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior access or another vulnerability) can trigger arbitrary… |
9,2 | 0,91 % | Brak wpisu w KEV nie wyklucza ataków | |
| skill-scanner | CVE-2026-26057 Skill Scanner is a security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. A vulnerability in the API Server of Skill Scanner could allow a unauthenticated, remote attacker to interact with the server API and either trigger a denial of… |
9,1 | 0,38 % | Brak wpisu w KEV nie wyklucza ataków | |
| Cloud Suite | CVE-2026-2409 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument Injection.This issue affects Cloud Suite: before 25.2 HF1. |
9,3 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| Alfresco Transformation Service (Enterprise) / Alfresco Community (Transform Core) | CVE-2026-26339 Wstrzyknięcie argumentów w Hyland Alfresco umożliwia zdalne wykonanie kodu przez nieautoryzowanych atakujących. |
9,3 | 0,63 % | Brak wpisu w KEV nie wyklucza ataków | |
| semantic-kernel | CVE-2026-26030 Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39.4`. Users should upgrade this version or higher. As… |
9,9 | 3,91 % | Brak wpisu w KEV nie wyklucza ataków | |
| kata-containers | CVE-2026-24834 Luka w Kata Containers umożliwia zdalne wykonanie kodu jako root w mikro VM. |
8,8 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| jsPDF | CVE-2026-25940 Wstrzyknięcie obiektów PDF w jsPDF umożliwia wykonanie nieautoryzowanego kodu JavaScript. |
9,6 | 0,5 % | Brak wpisu w KEV nie wyklucza ataków | |
| Saisies pour formulaire | CVE-2025-71243 The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should immediately update to version 5.11.1 or later. |
9,3 | 5,6 % | Brak wpisu w KEV nie wyklucza ataków | |
| jsPDF | CVE-2026-25755 Wstrzyknięcie obiektów PDF w jsPDF umożliwia atakującemu wykonanie złośliwych działań. |
8,8 | 0,95 % | Brak wpisu w KEV nie wyklucza ataków | |
| Databank Accreditation Software | CVE-2025-9953 Obejście autoryzacji w Databank Accreditation Software umożliwia wstrzyknięcie SQL. |
9,8 | 0,39 % | Brak wpisu w KEV nie wyklucza ataków | |
| BiEticaret CMS | CVE-2025-8350 Brak uwierzytelnienia w BiEticaret CMS umożliwia ominięcie zabezpieczeń i manipulację odpowiedziami HTTP. |
9,8 | 0,62 % | Brak wpisu w KEV nie wyklucza ataków | |
| WorkTime (on-prem/cloud) | CVE-2025-15559 An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on… |
9,8 | 0,51 % | Brak wpisu w KEV nie wyklucza ataków | |
| Grand Restaurant | CVE-2026-23542 Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10. |
9,8 | 0,46 % | Brak wpisu w KEV nie wyklucza ataków | |
| WpEvently | CVE-2026-23549 Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.1.1. |
9,8 | 0,45 % | Brak wpisu w KEV nie wyklucza ataków | |
| DynamicWeb 9 | CVE-2026-2731 Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute code via simple web requests |
10,0 | 0,6 % | Brak wpisu w KEV nie wyklucza ataków | |
| Open Babel | CVE-2026-2704 Przepełnienie bufora w Open Babel umożliwia zdalne odczytanie danych poza przydzielonym obszarem pamięci. |
8,1 | 0,88 % | Brak wpisu w KEV nie wyklucza ataków | |
| Open Babel | CVE-2026-2705 A vulnerability was detected in Open Babel up to 3.1.1. The impacted element is the function OBAtom::SetFormalCharge in the library include/openbabel/atom.h of the component MOL2 File Handler. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit… |
8,1 | 0,84 % | Brak wpisu w KEV nie wyklucza ataków | |
| gogs | CVE-2026-25232 Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a direct POST request, completely bypassing… |
8,8 | 0,48 % | Brak wpisu w KEV nie wyklucza ataków | |
| s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions | CVE-2026-1994 The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to… |
9,8 | 0,43 % | Brak wpisu w KEV nie wyklucza ataków | |
| Slider Future | CVE-2026-1405 The Slider Future plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'slider_future_handle_image_upload' function in all versions up to, and including, 1.0.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the… |
9,8 | 3,47 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 19:02 UTC – 14.11.2026, 00:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.