Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.
CVE-2026-94175
Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.
#advisory
共收录 22911 条相关情报。
← 返回所有主题Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
CVE-2026-90888
Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during cont...
CVE-2026-7005
WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows at
WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitra...
CVE-2026-7004
WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allow
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values ...
CVE-2026-7003
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers
Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.
CVE-2026-78527
Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.
Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is enabled, the single-stage query engine authorizes only the...
CVE-2026-73322
Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is e
Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.
CVE-2026-73186
Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-66026
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-66025
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddle...
CVE-2026-62160
Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` pas
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and n...
CVE-2026-61854
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report
Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to GIF` command uses a request helper that validates a hostname's public IP addresses but then sends the actua...
CVE-2026-61840
Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to GIF` command uses a request helper that validates
Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might al...
CVE-2026-119117
Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the li
changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostC...
CVE-2026-119763
changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attacker
Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileg...
CVE-2026-119086
Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enable
Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource h...
CVE-2026-61826
Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/a
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.2, unpublished certificate records can be retrieved ...
CVE-2026-61806
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately author...
CVE-2026-61805
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version
myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, `Product (Artikel)` and `Category` management store the `name` parameter without adequate b...
CVE-2026-61804
myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, `Product (Artikel)` and `Category`