Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed SAML response to trigger this vulnerability.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 1,09 % · rekomendacja wg zapisanej polityki
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c…
Opis źródłowy NVD · ENCVSS 9,9 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10,…
Opis źródłowy NVD · ENCVSS 9,9 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 1,09 % · rekomendacja wg zapisanej polityki
Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 1,09 % · rekomendacja wg zapisanej polityki
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 6,08 % · rekomendacja wg zapisanej polityki
A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attackers to execute arbitrary commands in the context of the application without user interaction via sending a crafted payload in a text message.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 1,08 % · rekomendacja wg zapisanej polityki
A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed SAML response to trigger this vulnerability.
Opis źródłowy NVD · EN
Pilne działanie
CVSS 9,8 · EPSS 1,09 % · rekomendacja wg zapisanej polityki
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,9 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10,…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,9 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 1,09 % · rekomendacja wg zapisanej polityki
Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 1,09 % · rekomendacja wg zapisanej polityki
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 6,08 % · rekomendacja wg zapisanej polityki
A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attackers to execute arbitrary commands in the context of the application without user interaction via sending a crafted payload in a text message.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 1,08 % · rekomendacja wg zapisanej polityki