The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to Stored Cross-Site...
CVE-2026-93883
The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phon
#advisory
共收录 23210 条相关情报。
← 返回所有主题In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of...
CVE-2026-108474
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-103755
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-16681
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an...
CVE-2026-22061
Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-18524
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary...
CVE-2026-78797
An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in t
Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected...
CVE-2026-78835
Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.
OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP...
CVE-2026-75352
OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path par
OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP...
CVE-2026-75353
OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path p
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2025-8457
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP...
CVE-2026-75351
OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path pa
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
## Summary Vikunja ships with `cors.origins` defaulting to `http://127.0.0.1:*` and `http://localhost:*`, and sends `Ac
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
## Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion aut
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2...
## Description ### Summary In Vikunja v2.6.0 the project-permission engine resolves a user's effective permission on a
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
## Summary A collaborator removed from a project keeps a **live, automatic feed** of that project's contents, because n
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
### Summary In Vikunja v2.6.0 the task position recalculation that runs when a saved filter view is created fails open
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
### Summary Vikunja v2.6.0 introduced server-side sessions with revocation semantics: `DELETE /api/v2/user/sessions/{id
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
CVE-2026-107805
## Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controll
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
CVE-2026-107804
## Summary In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the e