Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in...
CVE-2026-24618
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HashThemes Hash Elements all
2026-06-13 归档
今日共收录 1165 条安全情报，包含 370 个 CVE，402 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters,...
CVE-2026-42932
Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predict
Naxclow devices use a server-side, per-device relay credential that never rotates and is re...
CVE-2026-50101
Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each
A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then...
CVE-2026-42947
A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently
The Naxclow platform API that returns device relay registration details exposes a persistent...
CVE-2026-50108
The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifyin
Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint
CVE-2026-46371
### Summary A vulnerability in Fleet's Apple MDM commands listing endpoint allowed authenticated users with the lowest-
Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint
CVE-2026-46370
### Summary A vulnerability in Fleet's labels host-listing endpoint allowed authenticated users with the lowest-privile
Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)
CVE-2026-53999
# Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs) ## Su
TYPO3 CMS has Broken Access Control in its Form Framework
CVE-2026-11607
### Problem Backend users with access to the Form Framework were able to use files not ending in `.form.yaml` as form de
TYPO3 CMS has Broken Access Control in the Recycler Module
CVE-2026-47349
### Problem Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for t
TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities
CVE-2026-47347
### Problem Applications that use `GeneralUtility::sanitizeLocalUrl` to allow only local URLs are vulnerable to open red
TYPO3 CMS: Destructive Actions on File Mount Folders
CVE-2026-47343
### Problem Non-privileged backend users with file mount access were able to perform write operations (move, delete, ren
TYPO3 HTML Sanitizer allows Cross-site Scripting
CVE-2026-47345
Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting
TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
CVE-2026-49741
### Problem Backend users with write access to the `form_definition` database table were able to directly create, update
TYPO3 CMS has Broken Access Control in its DataHandler
CVE-2026-47350
### Problem Backend users were able to move records to a different page without having edit permissions on the source pa
TYPO3 CMS has Broken Access Control in its Form Framework
CVE-2026-47346
### Problem Backend users with file write permissions were able to upload form definition files with mixed-case extensio
TYPO3 CMS has Broken Access Control in its Media Module
CVE-2026-49742
### Problem Backend users with file download permissions were able to download files from the fallback storage of the fi
TYPO3 CMS has Insecure Deserialization via Core API
CVE-2026-49740
### Problem TYPO3's cache frontend (`VariableFrontend`) and persistent key-value store (`Registry`) deserialized PHP pay
TYPO3 CMS has Broken Access Control in its File Abstraction Layer
CVE-2026-49738
### Problem The path allowance check in `GeneralUtility::isAllowedAbsPath()` performed a plain string prefix comparison
TYPO3 CMS has Broken Access Control in Backend API
CVE-2026-47352
### Problem Authenticated backend users were able to retrieve file metadata via several Backend API routes without prope