AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var
CVE-2026-108547
AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users t
2026-10-11 归档
今日共收录 1127 条安全情报，包含 372 个 CVE，412 篇安全通告，以及 88 篇研究论文。
← 返回归档列表Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration
CVE-2026-108546
Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote at
SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing
CVE-2026-108545
SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attacke
Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route
CVE-2026-108164
Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/
Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL
CVE-2026-108162 · CVE-2026-108163
Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified
Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For
CVE-2026-108163 · CVE-2026-108162
Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to
FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download
CVE-2026-108161
FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauth
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list
CVE-2026-107794
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typema
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument
CVE-2026-107373
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringi
Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch
CVE-2026-103636
Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_uni
Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch
CVE-2026-103635
Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). com
Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch
CVE-2026-103501
Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deseri
HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
CVE-2026-107657
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-
SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors ...
CVE-2026-97348
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and inclu
A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse AP...
CVE-2026-108523
A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission annotations. Low-pr...
CVE-2026-108669
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeC
Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions.
CVE-2026-107420
Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 vers
9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to in...
CVE-2026-108593
9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthentic...
CVE-2026-108548
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored ...
CVE-2026-96574
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post