Conditions administration did not consistently enforce tokens and component/mapped-item permissions.
CVE-2026-63280
Conditions administration did not consistently enforce tokens and component/mapped-item permissions.
2026-07-23 归档
今日共收录 1422 条安全情报，包含 546 个 CVE，469 篇安全通告，以及 113 篇研究论文。
← 返回归档列表Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authe...
CVE-2026-63265
Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissio
OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an a...
CVE-2026-13089
OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorith
An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal.
CVE-2025-60835
An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal.
An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and execute arbitrary code via the zipgenius.exe.
CVE-2025-50330
An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and execute
An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe.
CVE-2025-50329
An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and exec
An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web protection...
CVE-2025-50327
An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbi
BandiZip v.7.37 is affected by a Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected i...
CVE-2025-50325
BandiZip v.7.37 is affected by a Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypa
An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneCommander.exe component.
CVE-2025-50324
An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneComman
An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.
CVE-2025-44090
An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted
An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.
CVE-2025-44089
An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a cr
During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transform...
CVE-2026-9737
During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the m
Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by...
CVE-2026-64829
Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obta
The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read ...
CVE-2026-14899
The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) ha
When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to...
CVE-2026-14881
When importing connections in Compass it is possible to override some connection options that are otherwise can't be cha
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to r...
CVE-2026-13078
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability ca...
CVE-2026-13077
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read
An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation withi...
CVE-2026-13076
An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by p
An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The is...
CVE-2026-13075
An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via th
An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaus...
CVE-2026-13074
An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combinati