Apache Roller: XML external entity processing in OPML bookmark import
CVE-2026-82386
Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files
2026-09-29 归档
今日共收录 1279 条安全情报，包含 376 个 CVE，505 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups
CVE-2026-82348
Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring righ
Apache Roller: Stored cross-site scripting via uploaded media content type
CVE-2026-82387
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a use
Apache Roller: Stored cross-site scripting through incoming Trackback links
CVE-2026-82546
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an un
Apache Roller: Reflected XSS in the optional LDAP comment authenticator
CVE-2026-91206
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a rem
October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery
CVE-2026-101005
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file
Cesanta Mongoose MQTT Broker main.c fn stack-based overflow
CVE-2026-101003
A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the
OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery
CVE-2026-100909
A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathFor
Trusted Domain Project OpenARC libopenarc arc-canon.c arc_parse_canon_t null pointer dereference
CVE-2026-100895
A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1. Impacted is the function arc_pa
Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization
CVE-2026-100885
A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webku
Krayin laravel-crm attachment-download Endpoint acl.php resource injection
CVE-2026-100884
A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download
Krayin laravel-crm acl.php access control
CVE-2026-100883
A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file package
Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting
CVE-2026-100882
A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Web
Nezha before 2.2.7 Information Disclosure via /api/v1/profile
CVE-2026-101089
Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the
Nezha before 2.3.1 Denial of Service via Concurrent Server Delete
CVE-2026-101088
Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentinel worker (service/s
Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6
CVE-2026-101087
Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS web
Nezha Dashboard before 2.3.5 Task Type Validation Bypass
CVE-2026-101086
Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing aut
Nezha before 2.3.8 Denial of Service via Alert Rule
CVE-2026-101085
Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users
obot before v0.21.1 Authorization Bypass via /mcp-connect
CVE-2026-101084
obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticat
Obot before v0.23.0 Authentication Bypass via Registry API
CVE-2026-101063
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authen