Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is...
CVE-2026-92800
Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent document
2026-09-17 归档
今日共收录 2425 条安全情报，包含 1381 个 CVE，651 篇安全通告，以及 100 篇研究论文。
← 返回归档列表phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass...
CVE-2026-92806
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form ha
Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in...
CVE-2026-92796
Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL re
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application...
CVE-2026-76438
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are...
CVE-2026-92809
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authentica
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project...
CVE-2026-92802
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing
LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route,...
CVE-2026-92803
LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated acc
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction...
CVE-2026-92801
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactiv
OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker...
CVE-2026-92792
OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing
Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but...
CVE-2026-92789
Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions,...
CVE-2026-92793
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated use
LightGBM through 4.7.0 fails to validate child and split array values when parsing text models,...
CVE-2026-92786
LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to wr
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes...
CVE-2026-92788
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class...
CVE-2026-92785
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist val
Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign,...
CVE-2026-92790
Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper t
Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint,...
CVE-2026-92791
Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated att
Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint...
CVE-2026-92783
Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with r
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules,...
CVE-2026-92776
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to a
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections,...
CVE-2026-92782
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated a
CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form...
CVE-2026-92778
CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers