Budibase before 3.45.0 Information Disclosure via Chat Links
CVE-2026-100685
Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enume
2026-09-27 归档
今日共收录 1038 条安全情报，包含 222 个 CVE，481 篇安全通告，以及 74 篇研究论文。
← 返回归档列表Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC
CVE-2026-100684
Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server.
Grav before 2.0.25 Session Cookie Theft via Twig Sandbox
CVE-2026-100671
Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Tw
vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation
CVE-2026-100653
vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-
vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids
CVE-2026-100652
vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC fron
vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass
CVE-2026-100651
vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1
SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth
CVE-2026-100642
SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-scree
SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL
CVE-2026-100639
SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutt
SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder
CVE-2026-100636
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authe
SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows
CVE-2026-100634
SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the
Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery
CVE-2026-100632
Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, Live
Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account
CVE-2026-100620
Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onb
Capgo SSO Provider ID Authentication Bypass via Incomplete Migration
CVE-2026-100612
Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table.
Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard
CVE-2026-100608
Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode w
Flowise through 3.1.4 Authentication Bypass via Email-Only SSO
CVE-2026-100607
Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifi
Flowise through 3.1.4 Authentication Bypass via SSO Email Match
CVE-2026-100606
Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login pat
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail...
CVE-2026-100833
Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all containe
Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before...
CVE-2025-71423
Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initialize