KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or…
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. From version 0.2.5 to before version 0.2.10, an unauthenticated remote code execution (RCE) vulnerability exists in the MCP stdio configuration validation.…
Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched…
Obejście konfiguracji w Backstage umożliwia zdalne wykonanie dowolnego kodu.
ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in…
ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to…
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, there is a server-side request forgery vulnerability in notification testers. This issue has been patched in version 4.6.2.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there is an IDOR vulnerability, leading to account takeover and enterprise feature bypass via SSO configuration. This issue has been patched in…
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, Flowise trusts any HTTP client that sets the header x-request-from: internal, allowing an authenticated tenant session to bypass all /api/v1/**…
XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier vulnerability in the /goform/SetLogin endpoint that allows remote attackers to hijack authenticated sessions. Attackers can predict session…
XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain an OS command injection vulnerability in the /goform/PingTestSet endpoint that allows unauthenticated remote attackers to execute arbitrary operating system commands. Attackers…
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured audience…
Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write…
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authentication vulnerabilities exist in Rocket.Chat's enterprise DDP Streamer service. The…
W locutus przed wersją 3.0.0 występuje luka RCE umożliwiająca wstrzyknięcie kodu JavaScript.
Obejście uwierzytelnienia w Rocket.Chat umożliwia atakującemu zalogowanie się jako dowolny użytkownik, co prowadzi do przejęcia konta.
Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination…
Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged…
Brak odpowiednich mechanizmów uwierzytelniania w WebSocketach umożliwia nieautoryzowane przejęcie stacji.
Brak odpowiednich mechanizmów uwierzytelniania w WebSocketach umożliwia nieautoryzowane przejęcie stacji.
OOP CMS BLOG 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by crafting malicious POST requests. Attackers can submit forms to the addUser.php endpoint with parameters…
Luka w Easyndexer 1.0 umożliwia nieautoryzowanym atakującym pobieranie wrażliwych plików przez manipulację parametrem pliku.
An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without…
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based…
SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any sql query on the database. This issue…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-30855 WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant management endpoints of… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,38 % | ||
| CVE-2026-30861 WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. From version 0.2.5 to before version 0.2.10, an unauthenticated remote code execution… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 2,38 % | ||
| CVE-2026-30851 Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,29 % | ||
| CVE-2026-29186 Obejście konfiguracji w Backstage umożliwia zdalne wykonanie dowolnego kodu. |
Wysoki priorytet |
CVSS 9,8EPSS 0,87 % | ||
| CVE-2026-29191 ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account… |
Wysoki priorytet |
CVSS 9,3EPSS 0,46 % | ||
| CVE-2026-29067 ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL… |
Wysoki priorytet |
CVSS 9,3EPSS 0,37 % | ||
| CVE-2026-30840 Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, there is a server-side request forgery vulnerability in notification testers. This issue has… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,52 % | ||
| CVE-2026-30823 Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there is an IDOR vulnerability, leading to account takeover and enterprise… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,47 % | ||
| CVE-2026-30820 Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, Flowise trusts any HTTP client that sets the header x-request-from:… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,54 % | ||
| CVE-2026-25072 XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier vulnerability in the /goform/SetLogin endpoint that allows remote attackers… |
Wysoki priorytet |
CVSS 9,8EPSS 0,56 % | ||
| CVE-2026-25070 XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain an OS command injection vulnerability in the /goform/PingTestSet endpoint that allows unauthenticated remote… |
Wysoki priorytet |
CVSS 9,8EPSS 3,31 % | ||
| CVE-2026-30223 OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,33 % | ||
| CVE-2026-29789 Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,43 % | ||
| CVE-2026-30831 Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authentication vulnerabilities… |
Wysoki priorytet |
CVSS 9,8EPSS 0,38 % | ||
| CVE-2026-29091 W locutus przed wersją 3.0.0 występuje luka RCE umożliwiająca wstrzyknięcie kodu JavaScript. |
Wysoki priorytetPubliczny PoC |
CVSS 8,1EPSS 0,89 % | ||
| CVE-2026-28514 Obejście uwierzytelnienia w Rocket.Chat umożliwia atakującemu zalogowanie się jako dowolny użytkownik, co prowadzi do przejęcia konta. |
Wysoki priorytet |
CVSS 9,8EPSS 0,55 % | ||
| CVE-2026-29064 Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted… |
Wysoki priorytetPubliczny PoC |
CVSS 8,2EPSS 0,26 % | ||
| CVE-2026-29075 Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in… |
Wysoki priorytet |
CVSS 9,8EPSS 0,41 % | ||
| CVE-2026-26288 Brak odpowiednich mechanizmów uwierzytelniania w WebSocketach umożliwia nieautoryzowane przejęcie stacji. |
Wysoki priorytet |
CVSS 9,8EPSS 0,66 % | ||
| CVE-2026-26051 Brak odpowiednich mechanizmów uwierzytelniania w WebSocketach umożliwia nieautoryzowane przejęcie stacji. |
Wysoki priorytet |
CVSS 9,8EPSS 0,9 % | ||
| CVE-2018-25200 OOP CMS BLOG 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by crafting malicious POST requests.… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,18 % | ||
| CVE-2018-25178 Luka w Easyndexer 1.0 umożliwia nieautoryzowanym atakującym pobieranie wrażliwych plików przez manipulację parametrem pliku. |
Wysoki priorytetPubliczny PoC |
CVSS 8,7EPSS 0,66 % | ||
| CVE-2026-2330 An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing… |
Wysoki priorytet |
CVSS 9,4EPSS 0,73 % | ||
| CVE-2026-2331 An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical… |
Wysoki priorytet |
CVSS 9,8EPSS 0,98 % | ||
| CVE-2026-29073 SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not admin rights, any logged-in… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,37 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 23:02 UTC – 13.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.