KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request…
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This…
Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe() is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both…
conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization (the project has no…
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long…
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost…
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in…
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.
Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before registering the CPSW ports. If cpsw_register_ports() fails, the error path only…
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy_to_user failure If kfd_dbg_trap_enable() fails while copying runtime_info to userspace, it had already activated the trap, set…
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-115752 Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers… |
Pozostałe |
CVSS 2,3EPSS 0,18 % | ||
| CVE-2026-54711 pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information… |
Pozostałe |
CVSS 2,4EPSS 0,16 % | ||
| CVE-2026-55190 Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe() is the SSRF guard… |
Pozostałe |
CVSS 6,5EPSS 0,26 % | ||
| CVE-2026-55422 conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML… |
Pozostałe |
CVSS 4,6EPSS 0,16 % | ||
| CVE-2026-115728 @hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated… |
Monitoruj |
CVSS 8,7EPSS 0,47 % | ||
| CVE-2026-115729 @pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can… |
Monitoruj |
CVSS 8,9EPSS 0,44 % | ||
| CVE-2026-115730 i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers… |
Pozostałe |
CVSS 2,3EPSS 0,32 % | ||
| CVE-2026-112854 Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6. |
Wysoki priorytet |
CVSS 9,8EPSS 0,31 % | ||
| CVE-2026-112855 Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5. |
Wysoki priorytet |
CVSS 9,8EPSS 0,31 % | ||
| CVE-2026-112856 Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10. |
Wysoki priorytet |
CVSS 9,8EPSS 0,31 % | ||
| CVE-2026-112857 Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8. |
Wysoki priorytet |
CVSS 9,8EPSS 0,41 % | ||
| CVE-2026-112858 Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3. |
Wysoki priorytet |
CVSS 9,8EPSS 0,31 % | ||
| CVE-2026-112859 Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16. |
Wysoki priorytet |
CVSS 9,8EPSS 0,31 % | ||
| CVE-2026-112863 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a… |
Monitoruj |
CVSS 7,1EPSS 0,15 % | ||
| CVE-2026-112846 Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14. |
Wysoki priorytet |
CVSS 9,8EPSS 0,31 % | ||
| CVE-2026-112847 Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13. |
Wysoki priorytet |
CVSS 9,8EPSS 0,31 % | ||
| CVE-2026-112848 Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0. |
Wysoki priorytet |
CVSS 9,8EPSS 0,31 % | ||
| CVE-2026-112849 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from… |
Monitoruj |
CVSS 7,1EPSS 0,19 % | ||
| CVE-2026-112850 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File… |
Monitoruj |
CVSS 8,1EPSS 0,34 % | ||
| CVE-2026-112851 Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9. |
Wysoki priorytet |
CVSS 9,8EPSS 0,31 % | ||
| CVE-2026-112852 Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12. |
Monitoruj |
CVSS 8,1EPSS 0,26 % | ||
| CVE-2026-112853 Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1. |
Wysoki priorytet |
CVSS 9,8EPSS 0,41 % | ||
| CVE-2026-98909 In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before registering the… |
Brak pełnej oceny |
CVSS NieustaloneEPSS 0,19 % | ||
| CVE-2026-98910 In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy_to_user failure If kfd_dbg_trap_enable() fails while copying runtime_info… |
Brak pełnej oceny |
CVSS NieustaloneEPSS 0,17 % | ||
| CVE-2026-98911 In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the… |
Monitoruj |
CVSS 7,5EPSS 0,32 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 9.11.2026, 03:32 UTC – 9.11.2026, 05:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.