Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows...
CVE-2026-104478
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users
#advisory
共收录 23210 条相关情报。
← 返回所有主题Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self...
CVE-2026-104479
Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows...
CVE-2026-104475
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inj
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the...
CVE-2026-104433
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of includ
Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows...
CVE-2026-104476
Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to ret
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup...
CVE-2026-104474
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverifie
The web management service in affected RouterOS versions contains an integer underflow in its...
CVE-2026-84411
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling
Armatura One's database initialization routine assigns a fixed, vendor-defined password to the...
CVE-2026-94592
Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser accoun
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows...
CVE-2026-97212
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate...
CVE-2026-95102
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a res
Armatura One's message broker logs client connection credentials and the associated password in...
CVE-2026-94594
Armatura One's message broker logs client connection credentials and the associated password in plain text during normal
Armatura One stores database and message-broker credentials in an install configuration file,...
CVE-2026-94591
Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-1
The WebSocket Application Programming Interface lacks restrictions on the number of...
CVE-2026-97363
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc
Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID...
CVE-2026-105051
Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys
MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are...
CVE-2026-105043
MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simuli
The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private...
CVE-2026-105048
The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses).
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
CVE-2026-93474
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for...
CVE-2026-105049
Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and H
Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration...
CVE-2026-105046
Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.
Armatura One's backup and restore routine records the full database connection command, including...
CVE-2026-94593
Armatura One's backup and restore routine records the full database connection command, including the superuser password