Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Octopus Server | CVE-2026-117341 In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the… |
7,7 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| Octopus Server | CVE-2026-117466 In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator. |
8,6 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| Junie CLI | CVE-2026-117530 In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands |
6,7 | 0,11 % | Brak wpisu w KEV nie wyklucza ataków | |
| core | CVE-2026-117532 REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin,… |
9,3 | 0,68 % | Brak wpisu w KEV nie wyklucza ataków | |
| core | CVE-2026-117533 REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave… |
2,1 | 0,13 % | Brak wpisu w KEV nie wyklucza ataków | |
| core | CVE-2026-117534 REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or… |
5,1 | 0,1 % | Brak wpisu w KEV nie wyklucza ataków | |
| core | CVE-2026-116893 REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like… |
6,1 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| core | CVE-2026-116894 REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie can keep backend… |
2,3 | 0,16 % | Brak wpisu w KEV nie wyklucza ataków | |
| core | CVE-2026-116895 REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode:… |
5,1 | 0,1 % | Brak wpisu w KEV nie wyklucza ataków | |
| core | CVE-2026-116896 REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session… |
7,7 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| core | CVE-2026-116897 REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set… |
7,1 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| core | CVE-2026-116898 REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then… |
7,1 | 0,17 % | Brak wpisu w KEV nie wyklucza ataków | |
| core | CVE-2026-116899 REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the content_slice_status and… |
7,1 | 0,18 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-116887 Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payload… |
5,3 | 0,15 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-116888 SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical_name. Attackers can save a schema whose canonical_name holds script markup, which… |
5,4 | 0,15 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-116889 SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the CodeStringValueFormatter renders… |
5,3 | 0,16 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-116890 Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like… |
6,9 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-116891 SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values… |
5,1 | 0,17 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-116892 SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG… |
5,3 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-116880 Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup,… |
7,1 | 0,11 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-116881 Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete with an empty query,… |
5,3 | 0,16 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-116882 Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML() passes… |
4,8 | 0,15 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-116883 Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement() in… |
4,8 | 0,15 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-116884 SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top,… |
5,3 | 0,16 % | Brak wpisu w KEV nie wyklucza ataków | |
| SemanticMediaWiki | CVE-2026-116885 Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdmin ID lookup that allows unauthenticated attackers to inject markup through the unescaped id parameter. Attackers can lure an smw-admin administrator into opening a crafted… |
5,3 | 0,18 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 15.11.2026, 15:02 UTC – 15.11.2026, 20:17 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.