Pimcore has a CustomReports Share Bypass
CVE-2026-45704
### Summary `CustomReports` uses inconsistent authorization between the report listing endpoint and the report detail e
2026-05-28 归档
今日共收录 1581 条安全情报，包含 810 个 CVE，383 篇安全通告，以及 109 篇研究论文。
← 返回归档列表Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export
CVE-2026-45703
### Summary The `WordExport` export flow only checks whether the current backend user has the feature permission `word_
AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username
CVE-2026-45309
## Summary AsyncSSH 2.22.0 expands the OpenSSH-compatible `AuthorizedKeysFile` `%u` token with the raw SSH username duri
Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
CVE-2026-45305
### Description `Symfony\Component\Yaml\Parser::cleanup()` strips the optional `%YAML` directive header, leading commen
Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
CVE-2026-45304
### Description `Symfony\Component\Yaml\Parser` resolves YAML aliases (`*anchor`) during parsing. Aliases that referenc
Symfony hardened the parser when handling untrusted input
CVE-2026-45133
### Description `Symfony\Component\Yaml\Parser` is the entry point for parsing YAML strings into PHP values via `Yaml::
Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint
CVE-2026-45332
### Summary A Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password h
ROHC protocol dissector crash in Wireshark 4.6.0 to 4.6.5 and 4.4.0 to 4.4.15 allows denial of...
CVE-2026-9759
ROHC protocol dissector crash in Wireshark 4.6.0 to 4.6.5 and 4.4.0 to 4.4.15 allows denial of service
A path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path...
CVE-2026-8361
A path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path starting with /woshome
When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule...
CVE-2026-8359
When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to
Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows...
CVE-2026-49009
Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.
Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e.,...
CVE-2026-8360
Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, WOSWe
A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions...
CVE-2026-21785
A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlie
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.10.7,...
CVE-2026-1402
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.10.7, 18.11 before 18.11.4, an
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.10.7, 18...
CVE-2026-5296
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.10.7, 18.11 before 18.11.4, and 1
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7,...
CVE-2026-6713
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7, 18.11 before 18.11.4, an
GitLab has remediated an issue in GitLab EE affecting all versions from 11.5 before 18.10.7, 18...
CVE-2026-2601
GitLab has remediated an issue in GitLab EE affecting all versions from 11.5 before 18.10.7, 18.11 before 18.11.4, and 1
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 before 18.10.7,...
CVE-2026-8716
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 before 18.10.7, 18.11 before 18.11.4, an
Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control.
CVE-2026-33552
Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control.
Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
CVE-2026-45077
### Description `Symfony\Bridge\Monolog\Command\ServerLogCommand` (the `server:log` console command) is a development-t