JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows...
CVE-2026-108608
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to de
2026-10-11 归档
今日共收录 1127 条安全情报，包含 372 个 CVE，412 篇安全通告，以及 88 篇研究论文。
← 返回归档列表JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the...
CVE-2026-108612
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch han
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows...
CVE-2026-108607
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to de
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows...
CVE-2026-108609
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to re
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the...
CVE-2026-108611
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController...
CVE-2026-108606
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that al
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController...
CVE-2026-108605
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that al
Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
CVE-2026-66566
Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
CVE-2026-107805
## Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controll
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
CVE-2026-108260
### Summary `` renders a rich-text AST into the DOM and, for `a` nodes, assigns the node's URL straight to the anchor's
Shiny for Python has path traversal in bookmark restore
CVE-2026-108258
### Impact Shiny for Python's bookmark-restore path accepted a client-supplied `_state_id_` query-string value and join
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
CVE-2026-107842
`ModuleSearch` decides whether to filter protected pages out of search results based on the current value of `contao.sea
Contao: The registration module re-sends activation mails
CVE-2026-107843
`ModuleRegistration::compile()` reaches its follow-up registration branch on **any** POST to a page carrying the module.
Contao: Cross-site request forgery in custom backend actions
CVE-2026-107848
`RequestTokenListener` is the only generic `REQUEST_TOKEN` validator in Contao and it only runs on POST. On the GET side
Contao: Path traversal in the images controller
CVE-2026-107844
`ImagesController` joins the user controlled `{path}` onto the configured image target directory with `Path::join()`, wh
Contao: Improper access control in the preview links module
CVE-2026-107850
`core-bundle/config/services.yaml` registers the preview access voter with the class `Contao\CoreBundle\Security\Voter\D
Contao: Improper access control in the table access voter
CVE-2026-107851
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend,
Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API
CVE-2026-91970
# Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API ## Summary The al
Vikunja: Unbounded CSV row cardinality permits API process termination
CVE-2026-91969
# Unbounded CSV row cardinality permits API process termination ## Summary The authenticated v2 CSV migration route ca
Vikunja: Unbounded nested task-filter recursion permits API process termination
CVE-2026-91968
# Unbounded nested task-filter recursion permits API process termination ## Summary Authenticated task-list routes acc