CVE-2026-106765
An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.
MonitorujOpis źródłowy · EN
- CVSS
- 7,5
- EPSS
- 0,5 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
KATALOG PODATNOŚCI
Baza CVE
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
CVE-2026-102786
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
MonitorujOpis źródłowy · EN
- CVSS
- 8,6
- EPSS
- 0,26 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-93631
A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value…
MonitorujPubliczny PoCOpis źródłowy · EN
- CVSS
- 7,1
- EPSS
- 0,18 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-93633
A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII…
PozostałePubliczny PoCOpis źródłowy · EN
- CVSS
- 5,4
- EPSS
- 0,23 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-93634
A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account…
PozostałePubliczny PoCOpis źródłowy · EN
- CVSS
- 4,3
- EPSS
- 0,27 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-93636
An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the…
PozostałePubliczny PoCOpis źródłowy · EN
- CVSS
- 4,3
- EPSS
- 0,34 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-93638
A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that…
PozostałePubliczny PoCOpis źródłowy · EN
- CVSS
- 6,1
- EPSS
- 0,3 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-93639
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add…
MonitorujOpis źródłowy · EN
- CVSS
- 8,7
- EPSS
- 0,38 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-93640
A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose…
MonitorujOpis źródłowy · EN
- CVSS
- 7,8
- EPSS
- 0,12 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-57207
NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session…
PozostałeOpis źródłowy · EN
- CVSS
- 5,9
- EPSS
- 0,4 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-57208
Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path traversal vulnerability in Entire CLI allows an attacker with push access to the checkpoints repository to craft malicious checkpoint metadata that causes entire…
PozostałeOpis źródłowy · EN
- CVSS
- 6,2
- EPSS
- 0,38 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-93627
An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,27 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-93628
An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,27 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-93629
An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,27 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-93630
A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy…
PozostałeOpis źródłowy · EN
- CVSS
- 4,3
- EPSS
- 0,29 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-55826
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of…
MonitorujOpis źródłowy · EN
- CVSS
- 8,7
- EPSS
- 0,34 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-50053
A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token,…
PozostałeOpis źródłowy · EN
- CVSS
- 5,4
- EPSS
- 0,3 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-50056
A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately…
MonitorujOpis źródłowy · EN
- CVSS
- 7,8
- EPSS
- 0,34 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-50057
A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration…
MonitorujOpis źródłowy · EN
- CVSS
- 7,8
- EPSS
- 0,27 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-53918
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A…
MonitorujOpis źródłowy · EN
- CVSS
- 8,8
- EPSS
- 0,62 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-53920
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header…
MonitorujOpis źródłowy · EN
- CVSS
- 8,7
- EPSS
- 0,4 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-53921
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to…
Wysoki priorytetOpis źródłowy · EN
- CVSS
- 9,8
- EPSS
- 1,12 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-55606
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On…
PozostałeOpis źródłowy · EN
- CVSS
- 6,5
- EPSS
- 0,47 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-115479
baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,3 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-115480
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint accepts submissions without enforcing the form's auth_captcha setting.…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,32 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-106765 An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function. |
Monitoruj |
CVSS 7,5EPSS 0,5 % | ||
| CVE-2026-102786 Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5 |
Monitoruj |
CVSS 8,6EPSS 0,26 % | ||
| CVE-2026-93631 A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to… |
MonitorujPubliczny PoC |
CVSS 7,1EPSS 0,18 % | ||
| CVE-2026-93633 A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content… |
PozostałePubliczny PoC |
CVSS 5,4EPSS 0,23 % | ||
| CVE-2026-93634 A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through… |
PozostałePubliczny PoC |
CVSS 4,3EPSS 0,27 % | ||
| CVE-2026-93636 An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through… |
PozostałePubliczny PoC |
CVSS 4,3EPSS 0,34 % | ||
| CVE-2026-93638 A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme… |
PozostałePubliczny PoC |
CVSS 6,1EPSS 0,3 % | ||
| CVE-2026-93639 A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration… |
Monitoruj |
CVSS 8,7EPSS 0,38 % | ||
| CVE-2026-93640 A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The… |
Monitoruj |
CVSS 7,8EPSS 0,12 % | ||
| CVE-2026-57207 NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP… |
Pozostałe |
CVSS 5,9EPSS 0,4 % | ||
| CVE-2026-57208 Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path traversal vulnerability in Entire CLI allows an attacker with push access to the… |
Pozostałe |
CVSS 6,2EPSS 0,38 % | ||
| CVE-2026-93627 An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing meeting in a… |
Pozostałe |
CVSS 5,3EPSS 0,27 % | ||
| CVE-2026-93628 An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an… |
Pozostałe |
CVSS 5,3EPSS 0,27 % | ||
| CVE-2026-93629 An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email… |
Pozostałe |
CVSS 5,3EPSS 0,27 % | ||
| CVE-2026-93630 A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target… |
Pozostałe |
CVSS 4,3EPSS 0,29 % | ||
| CVE-2026-55826 The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism… |
Monitoruj |
CVSS 8,7EPSS 0,34 % | ||
| CVE-2026-50053 A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal… |
Pozostałe |
CVSS 5,4EPSS 0,3 % | ||
| CVE-2026-50056 A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The… |
Monitoruj |
CVSS 7,8EPSS 0,34 % | ||
| CVE-2026-50057 A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo… |
Monitoruj |
CVSS 7,8EPSS 0,27 % | ||
| CVE-2026-53918 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA… |
Monitoruj |
CVSS 8,8EPSS 0,62 % | ||
| CVE-2026-53920 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option… |
Monitoruj |
CVSS 8,7EPSS 0,4 % | ||
| CVE-2026-53921 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack… |
Wysoki priorytet |
CVSS 9,8EPSS 1,12 % | ||
| CVE-2026-55606 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order… |
Pozostałe |
CVSS 6,5EPSS 0,47 % | ||
| CVE-2026-115479 baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail… |
Pozostałe |
CVSS 5,3EPSS 0,3 % | ||
| CVE-2026-115480 baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint… |
Pozostałe |
CVSS 5,3EPSS 0,32 % |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 4.11.2026, 17:55 UTC – 4.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.
NVD · publikacjeOstatnie przetworzenie zakończone
NVD · aktualizacjeOstatnie przetworzenie zakończone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOstatnie przetworzenie zakończoneData modelu znajduje się przy rekordzie.