formie's unauthenticated front-end submission editing can overwrite existing submissions
CVE-2026-47266
### Impact Unauthenticated users could modify existing submissions by posting a known or guessed submission ID to `formi
2026-05-31 归档
今日共收录 804 条安全情报，包含 64 个 CVE，387 篇安全通告，以及 99 篇研究论文。
← 返回归档列表Nezha's authenticated DDNS webhook configuration allows blind SSRF from the dashboard host
CVE-2026-47268
#### Summary An authenticated Nezha dashboard user can create or update a DDNS profile with provider `webhook` and conf
Admidio writes session IDs and auto-login cookie values to application logs
CVE-2026-47234
## Summary When debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs th
Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders
CVE-2026-47231
## Summary `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` o
Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders
CVE-2026-47230
## Summary `modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the cross-folder m
Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`
CVE-2026-47227
## Summary `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) correspon
BoxLite has a Timeout Bypass Vulnerability
CVE-2026-47213
#### Summary BoxLite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI
Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification
CVE-2026-47212
### Description The Twilio SMS notifier bridge ships a webhook request parser used to authenticate and decode the statu
Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in...
CVE-2026-48557
Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanit
StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows...
CVE-2026-4387
StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication s
Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing...
CVE-2026-42500
Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid
Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery...
CVE-2026-48555
Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows rem
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
CVE-2026-49383
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。
Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。
Cookie settings
Cookie settings
Mozilla Monitor
Mozilla Monitor
The Mozilla Manifesto
The Mozilla Manifesto
Mozilla Foundation
Mozilla Foundation
Accessibility Policy
Accessibility Policy
Create an Account
Create an Account