APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard
CVE-2026-86120
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to en
2026-09-06 归档
今日共收录 918 条安全情报，包含 147 个 CVE，434 篇安全通告，以及 81 篇研究论文。
← 返回归档列表gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint
CVE-2026-86118
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authentic
Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
CVE-2026-86116
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any a
Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path
CVE-2026-86115
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skippi
Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints
CVE-2026-86114
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to creat
BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Records
CVE-2026-86113
BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authe
BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints
CVE-2026-86112
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing auth
BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses
CVE-2026-86111
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated
CVE-2026-86145
CVE-2026-86145
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursiv
CVE-2026-86144
CVE-2026-86144
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This ha
CVE-2026-86143
CVE-2026-86143
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to r
CVE-2026-86142
CVE-2026-86142
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer l
CVE-2026-86141
CVE-2026-86141
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., i
CVE-2026-86140
CVE-2026-86140
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
CVE-2026-86139
CVE-2026-86139
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
CVE-2026-86138
CVE-2026-86138
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
CVE-2026-86137
CVE-2026-86137
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro i
Compatibility Test Suite (CTS)
本输入条目标题为 'Compatibility Test Suite (CTS)'，来源标记为 Android Security Bulletin，但实际指向的是 Android 兼容性测试套件的官方文档页面，而非典型的安全漏洞公告。CTS
Compatibility Definition Document (CDD)
本次输入内容为 Android 兼容性定义文档（Compatibility Definition Document，CDD）的官方页面链接，而非安全漏洞公告或安全更新通告。Android CDD 是 Android 生态中定义设备必须满足的
Tools, build, and related reference
本输入条目为 Android Security Bulletin（Android 安全公告）中的一项参考文档链接，标题为“Tools, build, and related reference”，来源 URL 指向 source.andro