Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Apache SIS | CVE-2026-110733 Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query. This issue affects the sql-storage module of Apache SIS from version 1.0… |
5,4 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| Apache SIS | CVE-2026-110748 This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless their paths. It was possible, for example, to specify a path to a local file. However, these files were always expected to be in some… |
5,5 | 0,14 % | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-106781 An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges. |
7,8 | 0,15 % | Brak wpisu w KEV nie wyklucza ataków | |
| hackney | CVE-2026-97200 Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds… |
8,2 | 0,56 % | Brak wpisu w KEV nie wyklucza ataków | |
| Cynap Pure (Next Gen), Cynap Bridge / Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro / Cynap Videobar,… | CVE-2026-59106 A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected… |
9,3 | 0,55 % | Brak wpisu w KEV nie wyklucza ataków | |
| Cynap Pro, Cynap Core Pro / Cynap, Cynap Core | CVE-2026-59107 A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices… |
9,2 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| danmu_api | CVE-2026-116485 danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set… |
9,3 | 2,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| objenesis | CVE-2026-116486 Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in… |
2,0 | 0,14 % | Brak wpisu w KEV nie wyklucza ataków | |
| mcuxsdk-middleware-usb | CVE-2026-116487 NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or… |
5,1 | 0,3 % | Brak wpisu w KEV nie wyklucza ataków | |
| mcuxsdk-middleware-usb | CVE-2026-116488 NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past… |
7,0 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| crm | CVE-2026-116492 Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission… |
7,1 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| Mattermost | CVE-2026-116516 Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723 |
6,5 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| Kameleo | CVE-2026-116283 A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. The attack is possible to be carried out remotely. Upgrading to version 5.2.0 is able to mitigate this issue.… |
5,3 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| dolibarr | CVE-2026-116219 Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename… |
8,6 | 2,08 % | Brak wpisu w KEV nie wyklucza ataków | |
| JIZHICMS | CVE-2026-116274 A vulnerability has been found in JIZHICMS up to 2.5.6. This affects the function Pay of the file app/home/c/OrderController.php of the component Front-end Order Handler. Such manipulation of the argument orderno leads to improper authorization. The attack can be launched remotely. The exploit has… |
2,1 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| AllenNLP | CVE-2026-116275 A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve_class_name of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attack… |
2,1 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| Kameleo | CVE-2026-116280 A vulnerability was determined in Kameleo up to 5.0.1.26. Affected is the function InternalController.TestProxy of the file client-engine-application/f.cs of the component Proxy Validation. Executing a manipulation of the argument host/port can lead to server-side request forgery. The attack may… |
5,1 | 0,16 % | Brak wpisu w KEV nie wyklucza ataków | |
| Kameleo | CVE-2026-116281 A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information disclosure. The attack can only be performed from a local… |
4,8 | 0,1 % | Brak wpisu w KEV nie wyklucza ataków | |
| Kameleo | CVE-2026-116282 A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be… |
5,3 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| Webasyst Framework | CVE-2026-116213 Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or… |
6,9 | 0,45 % | Brak wpisu w KEV nie wyklucza ataków | |
| maccms10 / maccms10 | CVE-2026-116214 MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to… |
9,3 | 0,46 % | Brak wpisu w KEV nie wyklucza ataków | |
| maccms10 / maccms10 | CVE-2026-116215 MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it… |
2,3 | 0,16 % | Brak wpisu w KEV nie wyklucza ataków | |
| maccms10 / maccms10 | CVE-2026-116216 MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any… |
6,9 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| rosariosis | CVE-2026-116217 RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menu_id and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php… |
5,3 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| dolibarr | CVE-2026-116218 Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in… |
7,2 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 23:02 UTC – 14.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.