Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance
CVE-2026-85616
Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when
2026-09-05 归档
今日共收录 1726 条安全情报，包含 665 个 CVE，657 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Grav before 2.0.19 Remote Code Execution via sort filter
CVE-2026-85604
Grav before 2.0.19 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter.
Grav Admin before 2.0.20 Cross-Site Scripting via marked.js
CVE-2026-85601
Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@ht
Grav Admin before 2.0.21 Stored XSS via username
CVE-2026-85600
Grav Admin (getgrav/grav-plugin-admin2) versions , ", or ', allowing an attacker to register a username containing an HT
Traefik v3.7 Authentication Bypass via TLS Option Conflict
CVE-2026-85596
Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The
Traefik before v2.11.55 Authentication Bypass via digestAuth
CVE-2026-85595
Traefik versions before v2.11.55 contain an authentication bypass vulnerability in the digestAuth middleware where unkno
Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware
CVE-2026-85594
Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/s
phpMyFAQ before 4.1.8 Authorization Bypass via question/create
CVE-2026-85592
phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddin
phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change
CVE-2026-85591
phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint tha
phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable
CVE-2026-85590
phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable fu
phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API
CVE-2026-85589
phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints search
phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export
CVE-2026-85588
phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attacker
phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages
CVE-2026-85587
phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to
phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter
CVE-2026-85586
phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission
SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency
CVE-2026-85585
SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that
SiYuan before v3.8.2 Denial of Service via Auth Throttle
CVE-2026-85584
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that
SiYuan before v3.8.2 Path Traversal via symlink in file API
CVE-2026-85583
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that fo
SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth
CVE-2026-85582
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth hand
SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration
CVE-2026-85581
SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that
SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch
CVE-2026-85580
SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-se