Krajowa Izba Rozliczeniowa
Vulnerability activity for Krajowa Izba Rozliczeniowa: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.9MediumOct 29, 2026Krajowa Izba Rozliczeniowa Szafir Crypto / certificateCVE-2026-106036Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server. This issue was fixed in version 2.0 build 708.
- 2.3LowOct 29, 2026Krajowa Izba Rozliczeniowa Szafir Path traversal / file handlingCVE-2026-93571Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that will be saved in location chosen by attacker. This issue was fixed in version 2.0 build 708.
- 8.6HighJun 29, 2026Krajowa Izba Rozliczeniowa SzafirHost Path traversal / file handlingCVE-2026-13165SzafirHost verifies the downloaded native library archive with one JarFile parser (reading the Central Directory) but extracts native libraries with JarInputStream parser (reading sequentially from local file headers). An attacker who controls the served archive can insert a malicious DLL/SO/DYLIB as a local-file-header entry between the last legitimate entry and the Central Directory, without adding it to the Central Directory. The signature verifier never sees the injected entry and accepts th
See every Krajowa Izba Rozliczeniowa entry on the dashboard.
Top products
- Szafir2 CVEs in the last year
- SzafirHost1 CVE in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- ENISA EUVD · Oct 29, 2026EUVD-2026-113121 · Szafir accepts any client or server certificate without performing certificate and hostname validation,…CVE-2026-106036
- ENISA EUVD · Oct 29, 2026EUVD-2026-113120 · Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can…CVE-2026-93571
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.