CVE-2026-107092
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
Wysoki priorytetOpis źródłowy · EN
- CVSS
- 9,8
- EPSS
- 1,04 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
KATALOG PODATNOŚCI
Baza CVE
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
CVE-2026-107157
Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.
PozostałeOpis źródłowy · EN
- CVSS
- 2,0
- EPSS
- 0,15 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-94380
Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation. This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.
MonitorujOpis źródłowy · EN
- CVSS
- 8,1
- EPSS
- 0,32 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-96432
A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the…
PozostałeOpis źródłowy · EN
- CVSS
- 2,1
- EPSS
- 0,33 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-116263
A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The…
PozostałeOpis źródłowy · EN
- CVSS
- 1,2
- EPSS
- 0,14 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-116260
A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The…
PozostałeOpis źródłowy · EN
- CVSS
- 5,5
- EPSS
- 0,29 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-116261
A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to…
PozostałeOpis źródłowy · EN
- CVSS
- 2,0
- EPSS
- 0,2 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-116262
A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is…
PozostałeOpis źródłowy · EN
- CVSS
- 2,1
- EPSS
- 0,32 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-115718
Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,31 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-115720
Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard validates only the initial hostname before callers invoke requests.get(url) with default redirect-following and no IP…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,34 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-115717
Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get…
PozostałeOpis źródłowy · EN
- CVSS
- 6,3
- EPSS
- 0,31 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-105947
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications, and Consulting Co. Ltd. Logsign SIEM allows Path Traversal. This issue affects Logsign SIEM: from 6.4.120 before 6.4.122.
PozostałeOpis źródłowy · EN
- CVSS
- 6,5
- EPSS
- 0,39 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-89209
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not…
MonitorujOpis źródłowy · EN
- CVSS
- 7,6
- EPSS
- 0,26 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-116256
A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function image of the file application/mp/controller/Show.php of the component Mp Module Media Proxy. The manipulation of the…
PozostałeOpis źródłowy · EN
- CVSS
- 5,5
- EPSS
- 0,35 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-116257
A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing…
PozostałeOpis źródłowy · EN
- CVSS
- 5,5
- EPSS
- 0,63 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-116258
A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly…
PozostałeOpis źródłowy · EN
- CVSS
- 2,1
- EPSS
- 0,24 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-116259
A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afc_get_device_info_key of the file src/afc.c of the component Device Info Handler. Performing a manipulation of the argument Value results in memory…
PozostałeOpis źródłowy · EN
- CVSS
- 1,9
- EPSS
- 0,15 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-116469
MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed,…
MonitorujOpis źródłowy · EN
- CVSS
- 7,1
- EPSS
- 0,37 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-115953
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Stored XSS.This issue affects Geo Mashup: from n/a through 1.13.22.
PozostałeOpis źródłowy · EN
- CVSS
- 6,5
- EPSS
- 0,17 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-115954
Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Geo Mashup: from n/a through 1.13.22.
PozostałeOpis źródłowy · EN
- CVSS
- 5,4
- EPSS
- 0,18 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-115955
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Advanced Post Block - Post Grid for WordPress block editor advanced-post-block allows Stored XSS.This issue affects Advanced Post Block - Post Grid…
PozostałeOpis źródłowy · EN
- CVSS
- 6,5
- EPSS
- 0,17 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-115956
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer panorama allows Stored XSS.This issue affects Panorama Viewer – 360 Degree Image + Video Viewer:…
PozostałeOpis źródłowy · EN
- CVSS
- 6,5
- EPSS
- 0,17 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-115959
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,23 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-115960
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
PozostałeOpis źródłowy · EN
- CVSS
- 4,3
- EPSS
- 0,2 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-115961
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows Stored XSS.This issue affects B Slider: from n/a through 2.2.2.
PozostałeOpis źródłowy · EN
- CVSS
- 6,5
- EPSS
- 0,17 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-107092 NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. |
Wysoki priorytet |
CVSS 9,8EPSS 1,04 % | ||
| CVE-2026-107157 Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information. |
Pozostałe |
CVSS 2,0EPSS 0,15 % | ||
| CVE-2026-94380 Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation. This issue affects Liman MYS: from 2.3.4-1124… |
Monitoruj |
CVSS 8,1EPSS 0,32 % | ||
| CVE-2026-96432 A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing… |
Pozostałe |
CVSS 2,1EPSS 0,33 % | ||
| CVE-2026-116263 A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation… |
Pozostałe |
CVSS 1,2EPSS 0,14 % | ||
| CVE-2026-116260 A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation… |
Pozostałe |
CVSS 5,5EPSS 0,29 % | ||
| CVE-2026-116261 A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation… |
Pozostałe |
CVSS 2,0EPSS 0,2 % | ||
| CVE-2026-116262 A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web… |
Pozostałe |
CVSS 2,1EPSS 0,32 % | ||
| CVE-2026-115718 Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM… |
Pozostałe |
CVSS 5,3EPSS 0,31 % | ||
| CVE-2026-115720 Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard validates only the initial hostname before… |
Pozostałe |
CVSS 5,3EPSS 0,34 % | ||
| CVE-2026-115717 Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to… |
Pozostałe |
CVSS 6,3EPSS 0,31 % | ||
| CVE-2026-105947 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications, and Consulting Co. Ltd. Logsign SIEM allows Path… |
Pozostałe |
CVSS 6,5EPSS 0,39 % | ||
| CVE-2026-89209 A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9… |
Monitoruj |
CVSS 7,6EPSS 0,26 % | ||
| CVE-2026-116256 A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function image of the file… |
Pozostałe |
CVSS 5,5EPSS 0,35 % | ||
| CVE-2026-116257 A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the… |
Pozostałe |
CVSS 5,5EPSS 0,63 % | ||
| CVE-2026-116258 A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer… |
Pozostałe |
CVSS 2,1EPSS 0,24 % | ||
| CVE-2026-116259 A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afc_get_device_info_key of the file src/afc.c of the component Device Info… |
Pozostałe |
CVSS 1,9EPSS 0,15 % | ||
| CVE-2026-116469 MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists,… |
Monitoruj |
CVSS 7,1EPSS 0,37 % | ||
| CVE-2026-115953 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Stored XSS.This issue affects Geo Mashup:… |
Pozostałe |
CVSS 6,5EPSS 0,17 % | ||
| CVE-2026-115954 Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Geo Mashup: from n/a… |
Pozostałe |
CVSS 5,4EPSS 0,18 % | ||
| CVE-2026-115955 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Advanced Post Block - Post Grid for WordPress block editor… |
Pozostałe |
CVSS 6,5EPSS 0,17 % | ||
| CVE-2026-115956 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer panorama allows Stored… |
Pozostałe |
CVSS 6,5EPSS 0,17 % | ||
| CVE-2026-115959 Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
Pozostałe |
CVSS 5,3EPSS 0,23 % | ||
| CVE-2026-115960 Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
Pozostałe |
CVSS 4,3EPSS 0,2 % | ||
| CVE-2026-115961 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows Stored XSS.This issue affects B Slider: from n/a… |
Pozostałe |
CVSS 6,5EPSS 0,17 % |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 5.11.2026, 23:32 UTC – 6.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.
NVD · publikacjeOstatnie przetworzenie zakończone
NVD · aktualizacjeOstatnie przetworzenie zakończone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOstatnie przetworzenie zakończoneData modelu znajduje się przy rekordzie.