The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication...
CVE-2026-82454
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in toke
2026-08-30 归档
今日共收录 849 条安全情报，包含 76 个 CVE，428 篇安全通告，以及 85 篇研究论文。
← 返回归档列表Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking...
CVE-2026-82451
Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that...
CVE-2026-82448
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated
@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1...
CVE-2026-80192
@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) con
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions...
CVE-2026-14494
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.
The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of...
CVE-2026-77012
The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated end
The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified...
CVE-2026-16259
The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthentic
Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned...
CVE-2026-41012
Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vC
IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of...
CVE-2026-3686
IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limi
Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu...
CVE-2026-51662
Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentica
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due...
CVE-2026-19286
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcemen
IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send...
CVE-2026-3627
IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL state
IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could...
CVE-2026-18527
IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker t
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated...
CVE-2026-16821
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a format s
org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
CVE-2026-55860
### Summary The connector does not gate clear-text password authentication plugins on transport encryption. A hostile o
org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
CVE-2026-55857
### Summary When PAM (dialog) authentication is used, the connector can be coerced into sending the account password in
free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA
CVE-2026-55785
### Summary The AUSF component of free5GC compares authentication response values with normal Go equality helpers inste
free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI
CVE-2026-55784
### Summary The AUSF component of free5GC stores per-subscriber authentication state in a global `sync.Map` keyed only
Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens
CVE-2026-55867
### Impact Graylog contains an insecure direct object reference (IDOR) vulnerability in the token revocation endpoint.
Fortigate syslog message parser can be exploited to modify or delete fields from the original message
CVE-2026-55841
### Impact A security issue has been identified in Graylog affecting the parsing of syslog messages that use a key-valu