Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin
CVE-2026-109316
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated
2026-10-13 归档
今日共收录 1460 条安全情报，包含 709 个 CVE，466 篇安全通告，以及 13 篇研究论文。
← 返回归档列表Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page
CVE-2026-109314
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain p
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
CVE-2026-109313
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form
CVE-2026-109312
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the se
vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload
CVE-2026-109311
vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFm
SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template
CVE-2026-109310
SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content p
SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path
CVE-2026-109309
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection
CVE-2026-109308
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::acti
Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification
CVE-2026-109307
Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2F
Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition
CVE-2026-109306
Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicen
Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every
CVE-2026-109305
Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument
CVE-2026-109304
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig cr
Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries
CVE-2026-109302
Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to oper
Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation
CVE-2026-109299
Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with auto
Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules
CVE-2026-109297
Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator,
Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes
CVE-2026-109296
Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disable
Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image
CVE-2026-109294
Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticat
Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint
CVE-2026-109293
Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admi
Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url
CVE-2026-109291
Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to ex
Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview
CVE-2026-109290
Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that all