KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.
Nieprawidłowa walidacja danych w ColdFusion umożliwia zdalne wykonanie kodu bez interakcji użytkownika.
A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated…
A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized…
An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remote, unauthenticated attacker to bypass security controls and gain unauthorized access to the…
pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under node_modules/.pnpm-config. A malicious repository…
Wykorzystanie SSRF w Anti-Virus for ownCloud pozwala na atak na serwer.
Wykonanie dowolnego kodu w ownCloud z powodu niebezpiecznej metody w Updaterze.
Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5.
Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with…
An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested…
Brak walidacji wejścia w komponencie AWS SNS Apache Camel nie prowadzi do znanych exploitów.
Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component. The KeycloakSecurityPolicy of camel-keycloak guards a route by running…
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel Solr component. The camel-solr producer copies Exchange message…
Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's…
Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation parameters - the resolver to query, the name or domain to look up, the record type and class, and the…
Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations.…
Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage…
Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks(...) with only the subject-exists check…
Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an…
Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession…
Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use…
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component. The camel-docling component invokes the external `docling` command-line tool by assembling an argument list in…
ERP App developed by PROG MIS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to view application code and obtain the database account and password.
Prog Management System developed by PROG MIS has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain the database account and password.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-48614 An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full… |
Wysoki priorytet |
CVSS 9,9EPSS 0,58 % | ||
| CVE-2026-48316 Nieprawidłowa walidacja danych w ColdFusion umożliwia zdalne wykonanie kodu bez interakcji użytkownika. |
Wysoki priorytet |
CVSS 10,0EPSS 1,13 % | ||
| CVE-2026-40141 A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input… |
Wysoki priorytet |
CVSS 9,9EPSS 0,53 % | ||
| CVE-2026-40139 A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an… |
Wysoki priorytet |
CVSS 9,8EPSS 0,75 % | ||
| CVE-2026-5268 An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remote, unauthenticated attacker… |
Wysoki priorytet |
CVSS 9,1EPSS 0,66 % | ||
| CVE-2026-59195 pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config… |
Wysoki priorytetPubliczny PoC |
CVSS 8,2EPSS 0,4 % | ||
| CVE-2025-53830 Wykorzystanie SSRF w Anti-Virus for ownCloud pozwala na atak na serwer. |
Wysoki priorytet |
CVSS 9,1EPSS 0,46 % | ||
| CVE-2025-53827 Wykonanie dowolnego kodu w ownCloud z powodu niebezpiecznej metody w Updaterze. |
Wysoki priorytet |
CVSS 9,1EPSS 0,62 % | ||
| CVE-2026-6900 Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5. |
Wysoki priorytet |
CVSS 9,1EPSS 0,22 % | ||
| CVE-2026-49297 Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination… |
Wysoki priorytetPubliczny PoC |
CVSS 8,1EPSS 0,99 % | ||
| CVE-2026-12686 An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment.… |
Wysoki priorytet |
CVSS 9,3EPSS 0,37 % | ||
| CVE-2026-56140 Brak walidacji wejścia w komponencie AWS SNS Apache Camel nie prowadzi do znanych exploitów. |
Wysoki priorytet |
CVSS 9,8EPSS 0,74 % | ||
| CVE-2026-53913 Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component. The KeycloakSecurityPolicy… |
Wysoki priorytet |
CVSS 9,8EPSS 1,09 % | ||
| CVE-2026-48203 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache… |
Wysoki priorytet |
CVSS 9,1EPSS 0,6 % | ||
| CVE-2026-48204 Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to… |
Wysoki priorytet |
CVSS 9,8EPSS 0,73 % | ||
| CVE-2026-48205 Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation parameters - the resolver to query,… |
Wysoki priorytet |
CVSS 9,1EPSS 0,6 % | ||
| CVE-2026-43867 Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable… |
Wysoki priorytet |
CVSS 9,8EPSS 0,93 % | ||
| CVE-2026-46454 Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the Camel Exchange without applying… |
Wysoki priorytet |
CVSS 9,8EPSS 0,83 % | ||
| CVE-2026-46455 Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak… |
Wysoki priorytet |
CVSS 9,8EPSS 0,69 % | ||
| CVE-2026-46456 Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a… |
Wysoki priorytet |
CVSS 9,8EPSS 0,79 % | ||
| CVE-2026-24013 Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests… |
Wysoki priorytet |
CVSS 9,1EPSS 0,64 % | ||
| CVE-2026-24014 Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal… |
Wysoki priorytet |
CVSS 9,8EPSS 0,69 % | ||
| CVE-2026-40047 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component. The camel-docling component invokes the external… |
Wysoki priorytet |
CVSS 9,1EPSS 2,43 % | ||
| CVE-2026-14807 ERP App developed by PROG MIS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to view application code and obtain the database… |
Wysoki priorytet |
CVSS 9,3EPSS 0,63 % | ||
| CVE-2026-14808 Prog Management System developed by PROG MIS has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain the… |
Wysoki priorytet |
CVSS 9,3EPSS 0,69 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 8.11.2026, 11:32 UTC – 8.11.2026, 13:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.