KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
In modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
In MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp, there is a possible EoP due to memory corruption. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Podatność na twardo zakodowane hasło w firmware Tenda i24V3.0si umożliwia logowanie jako root.
Wbudowane hasło w firmware Tenda G1V3.1si umożliwia atakującym logowanie jako root.
W Feathersjs, luka w zabezpieczeniach umożliwia atakującemu uzyskanie ważnego tokena dostępu dla istniejącego użytkownika bez autoryzacji.
Brak walidacji argumentu id w Feathersjs umożliwia atakującym manipulację zapytaniami MongoDB, co może prowadzić do nieautoryzowanego dostępu do…
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpoint. The sort parameter is split by | and the first part (column name) is passed directly as an…
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levels table data endpoint. The sort[0][direction] and sort[0][sortField] parameters are concatenated directly into an…
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, the `confluence_download_attachment` MCP tool accepts a `download_path` parameter that is written to without any directory boundary…
GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code via the gsconfig editor module.…
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the…
Brak uwierzytelnienia w MCP Atlassian pozwala na zdalne wykonywanie żądań HTTP do dowolnego URL.
Błąd w simple-git umożliwia zdalne wykonanie kodu, omijając wcześniejsze poprawki.
PX4 Autopilot versions 1.12.x through 1.15.x contain a logic flaw in the mode switching mechanism. When switching from Auto mode to Manual mode while the drone is in the "ARMED" state (after landing and before the automatic disarm triggered by the…
PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the "Re-arm Grace Period" logic. The system incorrectly applies the in-air emergency re-arm logic to ground scenarios. If a pilot switches to Manual mode and re-arms…
Nieprawidłowe neutralizowanie danych w GitHub Enterprise Server umożliwia zdalne wykonanie kodu.
Wstrzyknięcie SQL w systemie automatyzacji stacji paliw umożliwia zdalne wykonanie kodu.
rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulations functionalities. The vulnerability exists in the JIT (Just-In-Time) compilation engine, which is…
Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, the SSE endpoint (/sse/v1/...) in Coral Server did not strongly validate that a connecting agent was a…
Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server did not enforce strong authentication between agents and the server within an active…
Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server allowed the creation of agent sessions through the /api/v1/sessions endpoint without…
Błąd w StudioCMS pozwala uwierzytelnionym użytkownikom na generowanie tokenów API dla innych, co prowadzi do eskalacji uprawnień.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-0120 In modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User… |
Wysoki priorytet |
CVSS 9,8EPSS 0,32 % | ||
| CVE-2026-0110 In MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp, there is a possible EoP due to memory corruption. This could lead to remote escalation of privilege with no additional execution privileges… |
Wysoki priorytet |
CVSS 9,8EPSS 0,32 % | ||
| CVE-2026-0111 In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional… |
Wysoki priorytet |
CVSS 9,8EPSS 0,32 % | ||
| CVE-2026-0113 In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional… |
Wysoki priorytet |
CVSS 9,8EPSS 0,32 % | ||
| CVE-2026-0114 In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User… |
Wysoki priorytet |
CVSS 9,8EPSS 0,32 % | ||
| CVE-2025-70798 Podatność na twardo zakodowane hasło w firmware Tenda i24V3.0si umożliwia logowanie jako root. |
Wysoki priorytetPubliczny PoC |
CVSS 8,4EPSS 0,19 % | ||
| CVE-2025-70802 Wbudowane hasło w firmware Tenda G1V3.1si umożliwia atakującym logowanie jako root. |
Wysoki priorytetPubliczny PoC |
CVSS 8,4EPSS 0,19 % | ||
| CVE-2026-29792 W Feathersjs, luka w zabezpieczeniach umożliwia atakującemu uzyskanie ważnego tokena dostępu dla istniejącego użytkownika bez autoryzacji. |
Wysoki priorytet |
CVSS 9,8EPSS 0,54 % | ||
| CVE-2026-29793 Brak walidacji argumentu id w Feathersjs umożliwia atakującym manipulację zapytaniami MongoDB, co może prowadzić do nieautoryzowanego dostępu do… |
Wysoki priorytet |
CVSS 9,8EPSS 0,48 % | ||
| CVE-2026-29172 Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpoint. The sort parameter is… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,45 % | ||
| CVE-2026-29174 Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levels table data endpoint. The sort[0][direction] and… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,46 % | ||
| CVE-2026-27825 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, the `confluence_download_attachment` MCP tool accepts a… |
Wysoki priorytet |
CVSS 8,0EPSS 11,5 % | ||
| CVE-2026-28495 GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to overwrite the gsconfig.php… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,31 % | ||
| CVE-2026-26308 Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how… |
Wysoki priorytetPubliczny PoC |
CVSS 8,2EPSS 0,31 % | ||
| CVE-2026-27826 Brak uwierzytelnienia w MCP Atlassian pozwala na zdalne wykonywanie żądań HTTP do dowolnego URL. |
Wysoki priorytetPubliczny PoC |
CVSS 8,2EPSS 13 % | ||
| CVE-2026-28292 Błąd w simple-git umożliwia zdalne wykonanie kodu, omijając wcześniejsze poprawki. |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 1,35 % | ||
| CVE-2026-26741 PX4 Autopilot versions 1.12.x through 1.15.x contain a logic flaw in the mode switching mechanism. When switching from Auto mode to Manual mode while the drone is in the "ARMED" state… |
Wysoki priorytetPubliczny PoC |
CVSS 8,1EPSS 0,26 % | ||
| CVE-2026-26742 PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the "Re-arm Grace Period" logic. The system incorrectly applies the in-air emergency re-arm logic to… |
Wysoki priorytetPubliczny PoC |
CVSS 8,1EPSS 0,26 % | ||
| CVE-2026-3854 Nieprawidłowe neutralizowanie danych w GitHub Enterprise Server umożliwia zdalne wykonanie kodu. |
Wysoki priorytet |
CVSS 8,8EPSS 39,8 % | ||
| CVE-2026-3843 Wstrzyknięcie SQL w systemie automatyzacji stacji paliw umożliwia zdalne wykonanie kodu. |
Wysoki priorytet |
CVSS 9,3EPSS 0,79 % | ||
| CVE-2026-30960 rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulations functionalities. The… |
Wysoki priorytet |
CVSS 9,4EPSS 0,2 % | ||
| CVE-2026-30968 Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, the SSE endpoint (/sse/v1/...) in… |
Wysoki priorytet |
CVSS 9,8EPSS 0,36 % | ||
| CVE-2026-30969 Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server did not enforce… |
Wysoki priorytet |
CVSS 9,1EPSS 0,4 % | ||
| CVE-2026-30970 Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server allowed the creation… |
Wysoki priorytet |
CVSS 9,1EPSS 0,33 % | ||
| CVE-2026-30944 Błąd w StudioCMS pozwala uwierzytelnionym użytkownikom na generowanie tokenów API dla innych, co prowadzi do eskalacji uprawnień. |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,59 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 23:02 UTC – 13.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.