AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token
CVE-2026-108548
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that
2026-10-11 归档
今日共收录 1127 条安全情报，包含 372 个 CVE，412 篇安全通告，以及 88 篇研究论文。
← 返回归档列表Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
CVE-2026-108261
### Summary The TinaCMS admin builds its preview `` from the `/~/*` hash-router splat without checking that the value s
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike Announces Continuous Identity for AI Agents
Stable Channel Update for ChromeOS / ChromeOS Flex
CVE-2026-95365 · CVE-2026-95338 · CVE-2026-95312 · CVE-2026-95313 · CVE-2026-95289 · CVE-2026-95373 · CVE-2026-95275 · CVE-2026-95280 · CVE-2026-95300 · CVE-2026-95304 · CVE-2026-95310 · CVE-2026-95335 · CVE-2026-95282 · CVE-2026-95351 · CVE-2026-95343 · CVE-2026-95306 · CVE-2026-95305 · CVE-2026-95333 · CVE-2026-95374 · CVE-2026-95318 · CVE-2026-95344 · CVE-2026-95364 · CVE-2026-95274 · CVE-2026-95277 · CVE-2026-95339 · CVE-2026-95342 · CVE-2026-95316 · CVE-2026-95356 · CVE-2026-95293 · CVE-2026-95311 · CVE-2026-95340 · CVE-2026-95286 · CVE-2026-95348
The Stable channel is being updated to OS version 16805.33.0 (Browser version 154.0.8037.151) for most ChromeOS devices
Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch
CVE-2026-108594
Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch tha
Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers
CVE-2026-108581
TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileg
PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header
CVE-2026-108555
PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other
PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input
CVE-2026-108554
PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticate
SkillHub before 0.2.22 Account Takeover via Account Merge Flow
CVE-2026-108550
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeControll
Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses
CVE-2026-108115
Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to b
Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch
CVE-2026-103513
Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). A c
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
CVE-2026-42716
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch...
CVE-2026-108669
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeC
Vikunja: Link-share token can enumerate users through the v2 API
CVE-2026-91981
### Summary A link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-s
Firefox browsers
Firefox browsers
Sign in to Cloud
Sign in to Cloud