Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants
CVE-2026-109317
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to
#advisory
共收录 23075 条相关情报。
← 返回所有主题Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin
CVE-2026-109316
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated
Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page
CVE-2026-109314
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain p
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
CVE-2026-109313
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form
CVE-2026-109312
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the se
vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload
CVE-2026-109311
vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFm
SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template
CVE-2026-109310
SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content p
SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path
CVE-2026-109309
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection
CVE-2026-109308
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::acti
Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification
CVE-2026-109307
Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2F
Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition
CVE-2026-109306
Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicen
Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every
CVE-2026-109305
Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument
CVE-2026-109304
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig cr
Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query
CVE-2026-109303
Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authentica
Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries
CVE-2026-109302
Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to oper
Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL
CVE-2026-109301
Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing
Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds
CVE-2026-109300
Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, whic
Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation
CVE-2026-109299
Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with auto
Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex
CVE-2026-109298
Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a r
Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules
CVE-2026-109297
Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator,