CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a...
CVE-2026-88418
CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-c
#advisory
共收录 23334 条相关情报。
← 返回所有主题A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine ...
CVE-2026-76713
A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful explo
Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for...
CVE-2026-76716
Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for unauthorized access or deni
A vulnerability in an administrative component of Analytics and Location Engine (ALE) is...
CVE-2026-76715
A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-midd
An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index...
CVE-2026-88419
An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=
A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized...
CVE-2026-76712
A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information di
A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule...
CVE-2026-88341
A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can
Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated...
CVE-2026-76714
Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary co
A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may...
CVE-2026-76710
A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure
Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to...
CVE-2026-88624
Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recu
An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled ...
CVE-2026-88340
An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vu
A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted...
CVE-2026-76711
A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly process
The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded...
CVE-2026-89281
The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability
A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the...
CVE-2026-76717
A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive inf
Home Assistant: XSS in Statistics Graph Card
CVE-2026-91130
### Summary An authenticated party can add a malicious name to any statistics-capable entity, allowing for Cross-Site Sc
Home Assistant: mDNS Server-Side Request Forgery
CVE-2026-91129
## Summary Home Assistant Green is vulnerable to a Server-Side Request Forgery (SSRF) via the mDNS/Zeroconf IPP integra
Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
CVE-2026-88010
## Summary Traefik's BasicAuth middleware coalesces concurrent credential checks through a `singleflight.Group` to avoi
Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter
CVE-2026-88978
# Cross-tenant disclosure risk on `DurableTask` bidi RPC This is a low-severity, low-risk cross-tenant data exposure vu
Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher
CVE-2026-84298
## Summary The V1 `DurableTask` stream handler registers worker-supplied durable task external IDs in an in-memory call
Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses
CVE-2026-79913
**Summary** Cloudreve's server-side request forgery guard `ValidateExternalURL` (`pkg/request/ssrf.go`) resolves a user