CVE Program partner

CERT-PL

CERT.PL

API
CVEs, 365 days336554 all time, 1 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationCERT.PL
RoleCNA
TypeCERT
Reports toENISA → mitre
ScopeVulnerabilities in software discovered by CERT.PL, and vulnerabilities reported to CERT.PL for coordinated disclosure, which are not in another CNA’s scope.
Advisorieshttps://cert.pl/cve/

Latest CVEs · RSS

  • CVE-2026-106030 2026-10-16 · CVSS 6.8
    NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user
  • CVE-2026-88794 2026-10-15 · CVSS 8.2
    Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTY
  • CVE-2026-63315 2026-10-15 · CVSS 8.2
    WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user
  • CVE-2026-63314 2026-10-15 · CVSS 8.7
    WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an a
  • CVE-2026-35088 2026-10-15 · CVSS 8.2
    Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to th
  • CVE-2026-63316 2026-10-13 · CVSS 8.7
    A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers all
  • CVE-2026-103663 2026-10-08 · CVSS 6.9
    Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenti
  • CVE-2026-75820 2026-10-06 · CVSS 1.8
    GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wor
  • CVE-2026-75819 2026-10-06 · CVSS 1.8
    GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset f
  • CVE-2026-75818 2026-10-06 · CVSS 1.8
    GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer
  • CVE-2026-91784 2026-10-02 · CVSS 4.8
    cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization
  • CVE-2026-74865 2026-09-30 · CVSS 9.2
    sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unaut
  • CVE-2026-74864 2026-09-30 · CVSS 9.3
    sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without p
  • CVE-2026-41875 2026-09-29 · CVSS 6.9
    Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, wil
  • CVE-2026-85520 2026-09-29 · CVSS 9.3
    Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated at
  • CVE-2026-19547 2026-09-29 · CVSS 7.0
    Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript
  • CVE-2026-15390 2026-09-29 · CVSS 9.0
    Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP
  • CVE-2026-73642 2026-09-28 · CVSS 9.2
    Dayforce ESS Excelity is vulnerable to Path Traversal  in file download functionality. An unauthenticated attacker can sent GET request with file path parameter
  • CVE-2026-73641 2026-09-28 · CVSS 5.1
    Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitr
  • CVE-2026-73640 2026-09-28 · CVSS 9.3
    Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request w
  • CVE-2026-52749 2026-09-28 · CVSS 5.3
    The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a
  • CVE-2026-52748 2026-09-28 · CVSS 7.1
    The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication. This allows an unauthenticated remote atta
  • CVE-2026-82936 2026-09-28 · CVSS 5.9
    mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB l
  • CVE-2026-82935 2026-09-28 · CVSS 6.9
    mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device t
  • CVE-2026-82933 2026-09-28 · CVSS 6.0
    mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmit

All CVE Program partners