Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-108301
Tanium addressed an improper access controls vulnerability in Comply.
2026-10-28 归档
今日共收录 2009 条安全情报，包含 1141 个 CVE，471 篇安全通告，以及 100 篇研究论文。
← 返回归档列表An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the ...
CVE-2026-102816
An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthent
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback ...
CVE-2026-102815
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service run
An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated at...
CVE-2026-102814
An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local ne...
CVE-2026-102813
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interfac
A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vecto...
CVE-2026-102812
A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and A
A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker c...
CVE-2026-87897
A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentic
The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.
CVE-2026-82986
The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoi...
CVE-2026-82984
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("Yo
The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returnin...
CVE-2026-82983
The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user
A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.
CVE-2026-77173
A user could create a docx or odt file with a # in the filename with confidential information such as a credit card numb
App passwords were allowed to bypass password confirmation on sensitive endpoints.
CVE-2026-77172
App passwords were allowed to bypass password confirmation on sensitive endpoints.
A public shared collective always allowed recipients of the link to create pages.
CVE-2026-77171
A public shared collective always allowed recipients of the link to create pages.
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cle...
CVE-2026-77167
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. Th
A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.
CVE-2026-67400
A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or g
Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admi...
CVE-2026-54462
Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the
Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disc...
CVE-2026-48380
Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memo
Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o...
CVE-2026-48379
Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code exe
A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer_detail.php of the component Admin Rec...
CVE-2026-117514
A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the
A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer_search.php of the component Admin Search...
CVE-2026-117513
A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the fil