CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 02/11/2026 |
| CVE-2026-118052 | 中6.8 | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without releasing the Module Manager mutex when a module preamble declares a data or stack size that overflows the allocation arithmetic. Loading such an image blocks every later module load, start, stop and unlo | 02/11/2026 |
| CVE-2025-71450 | 低3.3 | inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read abyss[-1] via an embedded NUL byte after an overlong line. Attackers can supply an INI file or string with a line of at least INI_MAX_LINE-1 bytes followed by a NUL byte, causing undefined behavior r | 02/11/2026 |
| CVE-2025-62819 | 中6.5 | Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA (Registration Authority) User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status and/or profile settings | 02/11/2026 |
| CVE-2026-74993 | 高7.5 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection.
This issue affects Inventory Tracking Application: through 2026-10-16. | 02/11/2026 |
| CVE-2026-120463 | 中6.5 | Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the `other` document type. A | 02/11/2026 |
| CVE-2026-114364 | 緊急9.8 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope.
This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized opEvent parameters | 02/11/2026 |
| CVE-2026-113687 | 緊急9.8 | Improper isolation or compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox.
This issue affects Apache Syncope: from 3.0.0-M0 | 02/11/2026 |
| CVE-2026-113511 | 緊急9.1 | Authorization bypass through User-Controlled key vulnerability in Apache Syncope.
A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1 | 02/11/2026 |
| CVE-2026-111959 | 緊急9.1 | Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.
Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.
Users are recommended to upgr | 02/11/2026 |
| CVE-2026-110535 | 高8.8 | Improper Privilege Management vulnerability in Apache Syncope.
AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication.
This issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.
Users are recommended t | 02/11/2026 |
| CVE-2026-109083 | 緊急9.8 | Improper isolation or compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directl | 02/11/2026 |
| CVE-2026-105602 | 高8.6 | Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11. | 02/11/2026 |
| CVE-2026-105601 | 中5.3 | Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5 | 02/11/2026 |
| CVE-2026-105600 | 高8.6 | Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5 | 02/11/2026 |
| CVE-2026-103420 | 高7.2 | Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5 | 02/11/2026 |
| CVE-2026-103419 | 高8.6 | Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11. | 02/11/2026 |
| CVE-2026-102802 | 高8.9 | Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere can insert the text o | 02/11/2026 |