Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint
CVE-2026-108724
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmode
2026-10-12 归档
今日共收录 1168 条安全情报，包含 403 个 CVE，452 篇安全通告，以及 67 篇研究论文。
← 返回归档列表answer-me-with-html through 0.5.0 Symlink Following in Code Block src Embedding
CVE-2026-108723
answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where
open-computer-use through commit 610bac8 Stored XSS via log.html Session Log
CVE-2026-108722
open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file i
Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID
CVE-2026-108721
Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local
phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages
CVE-2026-108720
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to vi
Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration
CVE-2026-108718
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authoriz
Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController
CVE-2026-108717
Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows aut
mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant
CVE-2026-108716
mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends cl
LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php
CVE-2026-108715
LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php
MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket
CVE-2026-108714
MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exh
SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate
CVE-2026-108713
SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated
SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point
CVE-2026-108712
SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that
Plastic Labs Honcho through 3.3.0 Incorrect Authorization via POST /v3/workspaces
CVE-2026-108711
Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped
BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization
CVE-2026-108574
A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs
Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery
CVE-2026-108572
A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate
InstantSoft icms2 Image image.php files_delete_file path traversal
CVE-2026-108567
A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file syst
InstantSoft icms2 Private Message index.tpl.php index cross site scripting
CVE-2026-108566
A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file temp
Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/route...
CVE-2026-108980
Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plu
net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without first checking whether the neighbor cac...
CVE-2026-19577
net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privileged authenticated users to read any AI ...
CVE-2026-108878
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that