joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable...
CVE-2026-92599
joi (npm package `joi`, hapi.js) versions >=17.2.0 =18.0.0 <18.2.6 are vulnerable to regular expression denial of servic
#advisory
共收录 23421 条相关情报。
← 返回所有主题Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator...
CVE-2026-92594
Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fi
Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the...
CVE-2026-92593
Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirec
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib...
CVE-2026-92597
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a commen
Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the ...
CVE-2026-92595
Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAcc
Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the...
CVE-2026-92589
Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video...
CVE-2026-92585
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability...
CVE-2026-92590
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields
Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not...
CVE-2026-92591
Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes
n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git...
CVE-2026-92587
n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relativ
n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the...
CVE-2026-92588
n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endp
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video...
CVE-2026-92586
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the se
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker...
CVE-2026-92592
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun c
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the...
CVE-2026-92576
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the
TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an...
CVE-2026-89034
TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low En
AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery....
CVE-2026-92582
AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.js
In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values...
CVE-2026-92581
In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values before validation, allowin
In AVideo through 29.0, the API get_api_video endpoint contains a broken access control...
CVE-2026-92577
In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title
WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored...
CVE-2026-92578
WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a
AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting...
CVE-2026-92584
AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticat