Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.
CVE-2026-81785
Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.
2026-09-11 归档
今日共收录 1356 条安全情报，包含 483 个 CVE，489 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Unauthenticated PHP Object Injection in Wise Chat <= 3.4 versions.
CVE-2026-81784
Unauthenticated PHP Object Injection in Wise Chat <= 3.4 versions.
Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.
CVE-2026-81783
Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.
Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions.
CVE-2026-81782
Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions.
Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.
CVE-2026-81275
Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.
Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.
CVE-2026-66674
Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.
Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.
CVE-2026-66632
Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decom...
CVE-2026-46387
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate informatio...
CVE-2026-45747
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr
The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl78xx/) embeds a generic struct gnss_nmea0183_match_data match_data i...
CVE-2026-15461
The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl78xx/) embe
MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references (attributes, objects, and...
CVE-2026-88921
MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for re
Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the template ca...
CVE-2026-88915
Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates
EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to internal/private IP a...
CVE-2026-88896
EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who ...
CVE-2026-88895
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP r
Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, l...
CVE-2026-88894
Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the ch
OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share...
CVE-2026-88893
OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report defin
OpenPanel is an analytics platform. In all versions (no patched release available at time of publication), the data importer fetches a caller-supplied URL with plain fetch inste...
CVE-2026-88892
OpenPanel is an analytics platform. In all versions (no patched release available at time of publication), the data impo
OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers wit...
CVE-2026-88891
OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members t
OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interp...
CVE-2026-88890
OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder that fails to v
Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious dis...
CVE-2026-88889
Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to