Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation
CVE-2026-108733
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization
#advisory
共收录 23075 条相关情报。
← 返回所有主题Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
CVE-2026-108732
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization
Raven 2.0.0 through 3.0.0 Missing Authorization via join_workspace Invite-Only Bypass
CVE-2026-108731
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-
Raven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs
CVE-2026-108730
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py
Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoints
CVE-2026-108729
Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows
Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook
CVE-2026-108728
Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to o
EdgeEver through 1.108.0 Missing Authorization via Memo-Template API Routes
CVE-2026-108727
EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows
GLPI through 12.0.0 Missing Authorization via ajax/map.php
CVE-2026-108726
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privile
Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin
CVE-2026-108725
Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allo
Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint
CVE-2026-108724
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmode
answer-me-with-html through 0.5.0 Symlink Following in Code Block src Embedding
CVE-2026-108723
answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where
open-computer-use through commit 610bac8 Stored XSS via log.html Session Log
CVE-2026-108722
open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file i
Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID
CVE-2026-108721
Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local
phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages
CVE-2026-108720
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to vi
LLMGateway through 1.20.0 Blind SSRF via Video-Generation callback_url
CVE-2026-108719
LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reac
Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration
CVE-2026-108718
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authoriz
Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController
CVE-2026-108717
Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows aut
mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant
CVE-2026-108716
mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends cl
LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php
CVE-2026-108715
LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php
MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket
CVE-2026-108714
MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exh