Gardener: Authorization Bypass via Group Subject Injection
CVE-2026-79767
## Overview The `manage-members` custom verb authorization check in the Gardener API server's `customverbauthorizer` adm
#advisory
共收录 23334 条相关情报。
← 返回所有主题Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope
CVE-2026-77637
### Summary There is a privilege scope bypass in Cloudreve's admin API where two endpoints that mutate server state are
Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service
CVE-2026-77633
## Summary Cloudreve v4 splits the storage-quota **check** (reading the user's `used` bytes and comparing them to `MaxS
Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
CVE-2026-94462
## Summary The Store API v3 endpoint `PATCH /api/v3/store/carts/:id/associate` binds a guest cart to the authenticated
lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
CVE-2026-86062
### Summary The LightRAG WebUI renders assistant/answer chat content as **raw HTML** — `react-markdown` is configured wi
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
CVE-2026-85740
## Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack d
lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
CVE-2026-85734
### Summary The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can
lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function
CVE-2026-85725
### Summary When plaintext passwords are stored in AUTH_ACCOUNTS, the comparison uses Python's == operator which is not
lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
CVE-2026-85709
### Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+
Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs
CVE-2026-83805
### Impact This is an authorization bypass that escalates into unauthorized server-side job execution. 1. Primary impac
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text
CVE-2026-83801
### Impact _What kind of vulnerability is it? Who is impacted?_ It has two related instances that share the same root c
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
CVE-2026-77528
### Summary Autobahn Python enforces `maxMessagePayloadSize` against the compressed WebSocket frame length before permes
Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode
CVE-2026-76805
A vulnerability in Nuclei's DAST/fuzz expression evaluation path allows a malicious target server to trigger disclosure
Nuclei: Local File Read via Workflow File-Protocol Gate Bypass
CVE-2026-76804
A vulnerability in Nuclei's workflow template loader allows `file:` protocol templates to execute without the `-file` fl
Nuclei: Local File Read via MySQL Client Sandbox Bypass
CVE-2026-76803
A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the `-allow-lo
Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass
CVE-2026-76802
A vulnerability in Nuclei's DAST template loading path allows unsigned `code:` protocol templates to execute, bypassing
Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability
CVE-2026-76819
A vulnerability in the Goja JavaScript engine used by Nuclei's `javascript:` protocol allows arbitrary native code execu
Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service
CVE-2026-77561
### Summary Tinyauth's login rate-limit bookkeeping can enter a global lockdown mode when its in-memory login-attempt m
Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for
CVE-2026-77560
# tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an aut
Tinyauth: User enumeration attack by timing oracle
CVE-2026-77582
### Summary It's possible to enumerate users through a timing oracle. In other words: I can easily check if a username e