Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers,...
CVE-2026-92774
Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based acce
2026-09-17 归档
今日共收录 2425 条安全情报，包含 1381 个 CVE，651 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution...
CVE-2026-92779
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set hel
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App...
CVE-2026-92773
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it
ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint...
CVE-2026-92765
ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticate
OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's...
CVE-2026-92764
OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returni
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records...
CVE-2026-92771
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing
Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install...
CVE-2026-92772
Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks perm
Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through...
CVE-2026-92762
Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner...
CVE-2026-92770
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credenti
Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription...
CVE-2026-92760
Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restr
SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the...
CVE-2026-92759
SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to...
CVE-2026-92751
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that...
CVE-2026-92752
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in
PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and...
CVE-2026-92753
PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that
node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
CVE-2026-68904
SUMMARY ------- A combination of bugs in node-opcua causes unlimited TCP socket accumulation (FIN-WAIT-2 state) during a
djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data
CVE-2026-61595
### Impact `djust.tenants` isolation was enforced only on the HTTP path. The current tenant was stored in `threading.loc
djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler
CVE-2026-61598
### Impact `djust.mixins.model_binding.ModelBindingMixin` provides a default `update_model` event handler and is part of
OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS
CVE-2026-81192
### Summary The `OpenTelemetry.Resources.Host` NuGet package is affected by an untrusted search path vulnerability on m
djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG
CVE-2026-61590
### Impact djust's observability endpoints expose live view/session state and a remote method-invocation surface (`eval_
emp3r0r has an unauthenticated HTTP Polling DoS
CVE-2026-61554
### Summary The `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authent