Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Apache Tomcat | CVE-2025-66614 Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older… |
9,1 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2024-55270 phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata parameter. |
8,8 | 0,39 % | Brak wpisu w KEV nie wyklucza ataków | |
| RBG-100 | CVE-2026-23647 Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authentication to the underlying Linux system. Multiple local user accounts, including accounts with administrative privileges, were found to have fixed, embedded… |
9,3 | 0,66 % | Brak wpisu w KEV nie wyklucza ataków | |
| 777VR1 | CVE-2026-2617 A vulnerability was found in Beetel 777VR1 up to 01.00.09. This affects an unknown function of the component Telnet Service/SSH Service. The manipulation results in insecure default initialization of resource. The attack can only be performed from the local network. The exploit has been made… |
8,8 | 0,61 % | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-70828 Wykonanie dowolnego kodu w Datart przez parametr url w konfiguracji JDBC. |
8,8 | 0,56 % | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-70830 A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via injecting crafted Freemarker template syntax into the SQL script field. |
9,9 | 1,09 % | Brak wpisu w KEV nie wyklucza ataków | |
| OpenS100 | CVE-2026-22208 Wykorzystanie niezabezpieczonego interpretera Lua w OpenS100 pozwala na zdalne wykonanie kodu. |
9,4 | 1,1 % | Brak wpisu w KEV nie wyklucza ataków | |
| LightLLM | CVE-2026-26220 Brak uwierzytelnienia w LightLLM umożliwia zdalne wykonanie kodu przez atakującego. |
9,3 | 0,95 % | Brak wpisu w KEV nie wyklucza ataków | |
| Concierge::Sessions | CVE-2026-2439 Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defaults to using the uuidgen command to generate a UUID, with a fallback to using Perl's built-in rand function. Neither of these methods are… |
9,8 | 0,48 % | Brak wpisu w KEV nie wyklucza ataków | |
| Maypole | CVE-2025-15578 Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to the built-in rand() function, and the PID. |
9,8 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| VIP 3260 Z IA | CVE-2026-2564 A security flaw has been discovered in Intelbras VIP 3260 Z IA 2.840.00IB005.0.T. Affected by this vulnerability is an unknown functionality of the file /OutsideCmd. The manipulation results in weak password recovery. It is possible to launch the attack remotely. Attacks of this nature are highly… |
9,2 | 0,55 % | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-65716 An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file. |
8,8 | 0,84 % | Brak wpisu w KEV nie wyklucza ataków | |
| nanobot | CVE-2026-2577 The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to… |
10,0 | 0,65 % | Brak wpisu w KEV nie wyklucza ataków | |
| CF-N1 V2 | CVE-2026-2535 A vulnerability was found in Comfast CF-N1 V2 2.6.0.2. The impacted element is the function sub_44AB9C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_channel. The manipulation of the argument channel results in command injection. The attack can be launched remotely. The exploit has been… |
8,8 | 15,6 % | Brak wpisu w KEV nie wyklucza ataków | |
| DeepAudit | CVE-2026-2532 Wykorzystanie luki w DeepAudit umożliwia zdalne wykonanie ataku typu server-side request forgery. |
9,8 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| CF-N1 V2 | CVE-2026-2534 A vulnerability has been found in Comfast CF-N1 V2 2.6.0.2. The affected element is the function sub_44AC4C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_bandwidth. The manipulation of the argument bandwidth leads to command injection. The attack can be initiated remotely. The exploit… |
8,8 | 15,05 % | Brak wpisu w KEV nie wyklucza ataków | |
| WL-WN579A3 | CVE-2026-2530 Wstrzyknięcie poleceń w Wavlink WL-WN579A3 umożliwia zdalne wykonanie kodu. |
8,8 | 9,04 % | Brak wpisu w KEV nie wyklucza ataków | |
| WL-WN579A3 | CVE-2026-2526 Wstrzyknięcie poleceń w Wavlink WL-WN579A3 umożliwia zdalne wykonanie kodu. |
8,8 | 9,04 % | Brak wpisu w KEV nie wyklucza ataków | |
| eNet SMART HOME server | CVE-2026-26368 Brak autoryzacji w eNet SMART HOME pozwala na resetowanie haseł kont administratorów przez niskoprawnych użytkowników. |
8,7 | 0,58 % | Brak wpisu w KEV nie wyklucza ataków | |
| eNet SMART HOME server | CVE-2026-26369 W eNet SMART HOME serwerze występuje luka eskalacji uprawnień umożliwiająca uzyskanie dostępu administracyjnego. |
8,8 | 0,6 % | Brak wpisu w KEV nie wyklucza ataków | |
| Infotainment system ECU | CVE-2025-32058 The Infotainment ECU manufactured by Bosch uses a RH850 module for CAN communication. RH850 is connected to infotainment over the INC interface through a custom protocol. There is a vulnerability during processing requests of this protocol on the V850 side which allows an attacker with code… |
9,3 | 0,17 % | Brak wpisu w KEV nie wyklucza ataków | |
| Spam protection, Honeypot, Anti-Spam by CleanTalk | CVE-2026-1490 The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all versions up to, and including, 6.71. This makes it… |
9,8 | 1,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| Truelysell Core | CVE-2025-8572 The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the user_role parameter during user registration. This makes it possible for unauthenticated attackers to create accounts with… |
9,8 | 0,49 % | Brak wpisu w KEV nie wyklucza ataków | |
| midi-Synth | CVE-2026-1306 The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'export' AJAX action in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected… |
9,8 | 4,76 % | Brak wpisu w KEV nie wyklucza ataków | |
| caido | CVE-2026-24853 Obejście zabezpieczeń w Caido umożliwia dostęp do zablokowanych domen przez wstrzyknięcie nagłówka. |
9,8 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 19:02 UTC – 14.11.2026, 00:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.