A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in...
CVE-2026-15598
A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/ob
2026-07-14 归档
今日共收录 1138 条安全情报，包含 379 个 CVE，396 篇安全通告，以及 80 篇研究论文。
← 返回归档列表Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation...
CVE-2026-15683
Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability. This vulne
Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation
CVE-2026-52826
### Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the Web rate editing flows f
Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility
CVE-2026-52825
### Summary Kimai contains an authenticated improper authorization vulnerability in Team-related assignment APIs. A Tea
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
CVE-2026-52824
### Summary The official Kimai Docker image ships with `APP_SECRET=change_this_to_something_unique` as the default envi
Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation
CVE-2026-52822
### Summary Kimai 2.56.0 contains an authenticated authorization bypass in the timesheet `restart` and `duplicate` work
Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects
CVE-2026-52821
### Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the preset-project activity
Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass
CVE-2026-52820
## Summary The Timesheet API `PATCH /api/timesheets/{id}` and `POST /api/timesheets` endpoints accept a user-supplied `
Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target
CVE-2026-52819
## Summary `GET /api/timesheets?user=` (and `users[]=`) returns the targeted user's timesheet records to any caller tha
Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes
CVE-2026-49992
### Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcut
FacturaScripts: Account takeover of any 2FA-enabled user
CVE-2026-47677
# Authentication bypass in FacturaScripts: `/login?action=two-factor-validation` accepts brute-forceable TOTP without pa
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path...
CVE-2026-48364
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that c
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path...
CVE-2026-48363
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that c
A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function...
CVE-2026-15594
A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFromStorageKey in the l
LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request...
CVE-2025-45869
LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (SSRF). An unauthenti
The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all...
CVE-2026-12385
The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The...
CVE-2026-15595
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unkno
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via...
CVE-2026-12536
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ para
Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows...
CVE-2026-49971
Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymou
Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated...
CVE-2026-49972
Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remo