Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream
CVE-2026-110115
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileCo
2026-10-14 归档
今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。
← 返回归档列表oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints
CVE-2026-110114
FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to dele
PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint
CVE-2026-110113
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController t
JetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints
CVE-2026-110110
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query acces
JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save
CVE-2026-110109
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query acces
RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
CVE-2026-110106
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users
B3log Symphony through 3.6.4 Missing Authorization in Admin Console Routes
CVE-2026-110105
B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to rea
novel through 3.5.0 Unsalted MD5 Password Storage
CVE-2026-110104
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext pa
bbs-go through 4.4.6 Stored XSS via Image Upload Content-Type
CVE-2026-110103
bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML
powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer
CVE-2026-110102
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables T
Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads
CVE-2026-110101
Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload
Jorani before 1.0.4 Missing Authorization and SSRF via Contracts::import()
CVE-2026-110100
Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated
Jorani before 1.0.4 Missing Authorization in HR Export Actions
CVE-2026-110099
Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime a
Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests
CVE-2026-110098
Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify
Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token
CVE-2026-110097
Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password t
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
CVE-2026-94603
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carr
Frappe: Possibility of SQL injection in reportview
CVE-2026-55823
Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a coun
Frappe: Open Redirect via Unsanitized OAuth State Param.
CVE-2026-66057
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitize
GPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write
CVE-2026-109827
A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the
Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption
CVE-2026-19939
The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device