Admidio before 5.0.12 Authentication Bypass via RSS feeds
CVE-2026-82657
Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements
2026-08-31 归档
今日共收录 884 条安全情报，包含 132 个 CVE，408 篇安全通告，以及 86 篇研究论文。
← 返回归档列表Admidio before 5.0.12 Path Traversal via Photo ZIP Download
CVE-2026-82656
Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated user
Admidio before 5.0.12 SQL Injection via relation_type_list
CVE-2026-82655
Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php
SiYuan before v3.8.1 Stored XSS via block name
CVE-2026-82654
SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rende
SiYuan before v3.8.1 Information Disclosure via Publish Access
CVE-2026-82652
SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-vi
SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff
CVE-2026-82651
SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*pa
SiYuan before v3.8.1 Path Traversal via /api/template/render
CVE-2026-82650
SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function (kernel/mo
SiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search Path
CVE-2026-82649
SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element
keploy 3.1.0 through 3.6.25 Unauthenticated TLS Key Exposure
CVE-2026-82641
keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication,
NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure
CVE-2026-82639
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that
vastsa FileCodeBox Pickup Limit views.py update_file_usage race condition
CVE-2026-82543
A vulnerability was detected in vastsa FileCodeBox up to 2.3. This vulnerability affects the function update_file_usage
exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql
CVE-2026-77454
Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to bypass a scoping or authorization filter
Same-named aggregates with differing filters are conflated in AshSql
CVE-2026-81316
Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over
Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql
CVE-2026-81318
Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application t
Unescaped backslash allows LIKE wildcard injection in AshSql string search
CVE-2026-78691
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sql allows a user who s
Unbounded handle_error recursion enables denial of service in AshOban triggers
CVE-2026-78228
Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to
Job argument injection via :args overrides primary_key and tenant in AshOban
CVE-2026-78038
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban all
coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting
CVE-2026-82483
A vulnerability was detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This impacts an unknown functi
coppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.php cross site scripting
CVE-2026-82482
A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an
Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection....
CVE-2026-81852
Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce,