Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized...
CVE-2026-72662
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification,
2026-09-27 归档
今日共收录 1038 条安全情报，包含 222 个 CVE，481 篇安全通告，以及 74 篇研究论文。
← 返回归档列表Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via...
CVE-2026-82294
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via...
CVE-2026-82300
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege...
CVE-2026-77203
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions u
Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature...
CVE-2026-94132
Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterpri
Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0,...
CVE-2026-97162
Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5...
CVE-2026-97163
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin...
CVE-2026-97161
Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.
Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin...
CVE-2026-97160
Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0
Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing...
CVE-2026-94131
Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0
Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the...
CVE-2026-100720
Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authen
Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the...
CVE-2026-100719
Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command t
Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension <...
CVE-2026-94130
Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An SQL injectio
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA...
CVE-2026-100711
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user p
Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key...
CVE-2026-100708
Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in t
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens)...
CVE-2026-100709
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the a
Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender...
CVE-2026-100718
Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH...
CVE-2026-100713
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cr
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an...
CVE-2026-100712
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET r
Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(),...
CVE-2026-100710
Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDoma