Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| ruoyi-vue-pro / ruoyi-vue-pro | CVE-2026-116007 A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateSmsCode0 of the file /service/sms/SmsCodeServiceImpl.java of the component SMS Code Verification. This manipulation causes improper restriction of excessive… |
2,9 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| Onyx | CVE-2026-116004 A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed… |
2,0 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| PrivateGPT | CVE-2026-116000 A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request… |
5,5 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| Restaurant_IMS | CVE-2026-115999 A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible. This product… |
6,9 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| pig | CVE-2026-115997 A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql… |
2,1 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| Unitree Go2 | CVE-2026-115995 A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely.… |
9,4 | 1,38 % | Brak wpisu w KEV nie wyklucza ataków | |
| Unitree Go2 | CVE-2026-115996 A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated… |
6,3 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| phpIPAM | CVE-2026-115981 A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUEST_URI leads to cross site scripting. The attack may be launched remotely. The exploit has been… |
1,9 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| phpIPAM | CVE-2026-115982 A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation… |
2,1 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| Oracle Java SE / Oracle GraalVM for JDK / Oracle GraalVM Enterprise Edition | CVE-2026-114820 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle… |
9,1 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| Faveo Helpdesk | CVE-2026-115973 A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The… |
6,9 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| Opptrix | CVE-2026-115970 A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public… |
5,5 | 0,3 % | Brak wpisu w KEV nie wyklucza ataków | |
| Opptrix | CVE-2026-115971 A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and… |
5,5 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| Faveo Helpdesk | CVE-2026-115972 A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php.… |
6,9 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| Opptrix | CVE-2026-115969 A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has… |
5,5 | 1,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| CPython | CVE-2026-115557 Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration. |
9,4 | 0,53 % | Brak wpisu w KEV nie wyklucza ataków | |
| postiz-app | CVE-2026-115933 Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can… |
9,9 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| WpEvently | CVE-2026-114192 Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8. |
6,5 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| Web-Simple | CVE-2026-114629 Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored.… |
7,5 | 0,5 % | Brak wpisu w KEV nie wyklucza ataków | |
| Relevanssi | CVE-2026-114704 Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4. |
7,2 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków | |
| UPI QR Code Payment Gateway for WooCommerce | CVE-2026-114191 Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3. |
7,5 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| postiz-app | CVE-2026-115932 When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and… |
9,6 | 0,43 % | Brak wpisu w KEV nie wyklucza ataków | |
| xiaozhi-esp32-server | CVE-2026-116017 Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request… |
5,3 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| community-platform | CVE-2026-116018 ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of… |
5,3 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| grav | CVE-2026-116019 Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page… |
8,7 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 14.11.2026, 03:02 UTC – 14.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.