Kimai 2.61.0 before 2.63.0 Authentication Bypass via API
CVE-2026-84805
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in
2026-09-03 归档
今日共收录 1407 条安全情报，包含 491 个 CVE，487 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Kimai before 2.65.0 Authorization Bypass via Team Activity API
CVE-2026-84804
Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and custom
Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController
CVE-2026-84802
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::action
Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers
CVE-2026-84801
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-
Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file
CVE-2026-84800
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionR
Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite
CVE-2026-84798
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::
Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate
CVE-2026-84797
Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate()
Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass
CVE-2026-79990 · CVE-2026-84796
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fai
Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance
CVE-2026-84795
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactiva
Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset
CVE-2026-84794
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied.
Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name
CVE-2026-84793
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name fi
Craft CMS before 5.10.11 Broken Access Control via element-indexes
CVE-2026-84792
Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements end
CVE-2026-82958
CVE-2026-82958
In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a Cr
Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction
CVE-2026-19754
Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated use
FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update
CVE-2026-84715
FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allow
APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpoint
CVE-2026-84485
APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing
facefusion before 3.7.0 Path Traversal via Job Identifier
CVE-2026-84702
facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outs
Pika Unauthenticated Replication Access via Internal Protobuf Port
CVE-2026-84700
PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000
Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix
CVE-2026-84697
Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/614
Coolify before 4.2.0 Remote Code Execution via Environment Variable Key
CVE-2026-84694
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on man