browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in...
CVE-2026-92811
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints,
#advisory
共收录 23421 条相关情报。
← 返回所有主题changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps,...
CVE-2026-92815
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attac
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the...
CVE-2026-92810
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allo
ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing...
CVE-2026-92816
ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to ar
Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom...
CVE-2026-92813
Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing una
decap-server contains a path traversal vulnerability in the local proxy containment guard that...
CVE-2026-92812
decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications,...
CVE-2026-92814
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary marku
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on...
CVE-2026-92805
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in Conf
Nango through 0.70.4 fails to validate caller-supplied connection configuration values...
CVE-2026-92804
Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token
Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is...
CVE-2026-92800
Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent document
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass...
CVE-2026-92806
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form ha
Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in...
CVE-2026-92796
Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL re
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application...
CVE-2026-76438
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are...
CVE-2026-92809
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authentica
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project...
CVE-2026-92802
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing
LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route,...
CVE-2026-92803
LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated acc
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction...
CVE-2026-92801
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactiv
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity,...
CVE-2026-92787
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypas
@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into...
CVE-2026-92784
@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source co
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when...
CVE-2026-92794
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verif