Wszystkie CVE z ostatnich sześciu miesięcy, aktualizowane codziennie.

Pokazano 11 z 11

• ŚredniCVE-2026-54248Ocena CVSS 6.511 wrz 2026

  Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to in

  CWE-347CWE-501
• KrytycznyCVE-2026-44091Ocena CVSS 9.130 lip 2026

  An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.

  CWE-501
• ŚredniCVE-2026-65902Ocena CVSS 6.123 lip 2026

  DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sa

  CWE-501cure53 dompurify
• ŚredniCVE-2026-49458Ocena CVSS 6.114 lip 2026

  DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceo

  CWE-79CWE-501CWE-693cure53 dompurify
• KrytycznyCVE-2026-48746Ocena CVSS 9.122 cze 2026

  vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It al

  CWE-444CWE-501vllm vllm
• WysokiCVE-2026-33828Ocena CVSS 7.89 cze 2026

  Trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally.

  CWE-501microsoft windows_10_1607microsoft windows_10_1809microsoft windows_10_21h2
• KrytycznyCVE-2026-35051Ocena CVSS 10.030 kwi 2026

  Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behin

  CWE-345CWE-501traefik traefik
• WysokiCVE-2026-34780Ocena CVSS 8.34 kwi 2026

  Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame object

  CWE-668CWE-1188CWE-501electronjs electron
• ŚredniCVE-2026-24153Ocena CVSS 5.231 mar 2026

  NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead to information disclosure.

  CWE-501nvidia jetson_linuxnvidia jetson_agx_orin_32gbnvidia jetson_agx_orin_64gb
• WysokiCVE-2026-27893Ocena CVSS 8.827 mar 2026

  vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--tru

  CWE-693CWE-501vllm vllm
• WysokiCVE-2026-4687Ocena CVSS 8.624 mar 2026

  Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

  CWE-754CWE-120CWE-501mozilla firefox