immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization
CVE-2026-103532
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the
2026-10-02 归档
今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。
← 返回归档列表QloApps through 1.7.0 Reflected XSS via Length of Stay Fields
CVE-2026-103590
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's leng
QloApps through 1.7.0 Reflected XSS via Room Type Editor
CVE-2026-103589
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that f
QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters
CVE-2026-103587
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation Syste
pypdf: Possible long runtimes with large amount of embedded files
CVE-2026-102999
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files c
pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)
CVE-2026-102995
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source
langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is: src/b...
CVE-2026-51888
langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intende
The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker...
CVE-2026-51884
The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to pat
The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences (su...
CVE-2026-51883
The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path trave
Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, al...
CVE-2026-104058
Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin e
TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a syst...
CVE-2026-102294
TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM vi...
CVE-2026-94250
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unau
Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the checkUI deny list omits the /mcp-conne...
CVE-2026-103758
Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP s
Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf...
CVE-2026-103285
Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functio
The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1...
CVE-2026-97661
The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gatewa
The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway A...
CVE-2026-96255
The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on...
CVE-2026-81809
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks befor
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integri...
CVE-2026-81739
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbac
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not require authentication....
CVE-2026-80276
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible m
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change functio...
CVE-2026-80275
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side a