Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint
CVE-2026-108758
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauth
#advisory
共收录 23075 条相关情报。
← 返回所有主题Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes
CVE-2026-108756
Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-
Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint
CVE-2026-108755
Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated att
GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger
CVE-2026-108754
GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger
JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen
CVE-2026-108752
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite ano
MoAI-ADK through 3.1.2 Symlink Following via moai init Template Deployer
CVE-2026-108751
MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows
OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction
CVE-2026-108750
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust P
docling-serve 1.14.0 through 1.36.0 Missing Authentication via Memory Management Endpoints
CVE-2026-108749
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attacker
Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket
CVE-2026-108748
Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket
Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources
CVE-2026-108746
Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that igno
CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet
CVE-2026-108745
CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web ses
pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync
CVE-2026-108744
pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pb
CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation
CVE-2026-108742
CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that le
Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Checker
CVE-2026-108741
Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra b
GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment
CVE-2026-108740
GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that
Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback
CVE-2026-108738
Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into
Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion
CVE-2026-108737
Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tok
Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing
CVE-2026-108736
Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attack
Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL
CVE-2026-108735
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to rea
Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document
CVE-2026-108734
Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_docume