Hasura: Row-level authorization bypass on table computed fields
CVE-2026-54698
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a
2026-07-09 归档
今日共收录 1410 条安全情报，包含 455 个 CVE，561 篇安全通告，以及 105 篇研究论文。
← 返回归档列表Anki: User scripts in iframes have access to the internal Anki API
CVE-2026-58266
Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with t
OpenWrt: EAD Integer Underflow → Pre-Auth Denial of Service
CVE-2026-55490
OpenWrt is a Linux operating system targeting embedded devices. Before v25.12.5, an integer underflow in handle_send_a()
Koodo Reader: Remote code execution via malicious epub file
CVE-2026-55408
Koodo Reader is an ebook reader. In version 2.3.0 and earlier, Koodo Reader is vulnerable to remote code execution throu
Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
CVE-2026-50179
Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/s
Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
CVE-2026-46700
Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-serve
Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper
CVE-2026-46672
Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in pac
Actual: Shared users can perform owner-only file management actions
CVE-2026-50007
Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared us
calibre: Arbitrary Code Execution in Template Formatter via Book Metadata
CVE-2026-53511
calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when
CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation
CVE-2026-53935
Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 t
DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets
CVE-2026-50530
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface onl
DataEase: Link Token Leakage Prior to Share Password/Ticket Validation
CVE-2026-50529
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share int
DataEase: authenticated stored XSS in the dashboard text components
CVE-2026-55647
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stor
LocalAI - Server-Side Request Forgery via POST /models/apply
CVE-2026-59707
LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that al
DataEase: Authenticated SQL Injection in Chart Quota Filters
CVE-2026-55635
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, chart quota and Y-axis filters embed
DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)
CVE-2026-53751
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation l
DataEase: Unauthorized Access to Engine Database via previewSql Endpoint
CVE-2026-53730
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql en
DataEase H2 RCE via Zip Protocol & File Dropper Fix bypass
CVE-2026-55633
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a bypass of the H2 zip protocol and f
DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management
CVE-2026-55631
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows aut
DataEase ExportCenter IDOR allows cross-user export task access
CVE-2026-53729
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (