SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the...
CVE-2026-86191
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint t
2026-09-06 归档
今日共收录 918 条安全情报，包含 147 个 CVE，434 篇安全通告，以及 81 篇研究论文。
← 返回归档列表AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing...
CVE-2026-86186
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eigh
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in...
CVE-2026-15550
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and inclu
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task...
CVE-2026-86177
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subus
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API...
CVE-2026-86176
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, S
Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the...
CVE-2026-86174
Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. A
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized...
CVE-2025-9049
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a mi
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes...
CVE-2026-86185
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScri
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and...
CVE-2026-86178
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowin
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 -...
CVE-2026-12843
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and...
CVE-2026-86175
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authen
Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path...
CVE-2026-86169
Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_cod
Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback...
CVE-2026-86117
Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users in
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in...
CVE-2026-86120
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to en
SQL Chat contains four unauthenticated API endpoints that accept client-supplied database...
CVE-2026-86123
SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and exec
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint,...
CVE-2026-86118
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authentic
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without...
CVE-2026-86115
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skippi
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user...
CVE-2026-86114
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to creat
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint,...
CVE-2026-86111
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API...
CVE-2026-86116
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any a