ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint...
CVE-2026-92765
ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticate
#advisory
共收录 23421 条相关情报。
← 返回所有主题OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's...
CVE-2026-92764
OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returni
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records...
CVE-2026-92771
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing
Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install...
CVE-2026-92772
Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks perm
Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through...
CVE-2026-92762
Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner...
CVE-2026-92770
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credenti
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated,...
CVE-2026-76460
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to byp
WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view...
CVE-2026-92761
WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform pri
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector ...
CVE-2026-76450
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a
Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription...
CVE-2026-92760
Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restr
SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the...
CVE-2026-92759
SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to...
CVE-2026-92751
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that...
CVE-2026-92752
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in
PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and...
CVE-2026-92753
PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that
node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
CVE-2026-68904
SUMMARY ------- A combination of bugs in node-opcua causes unlimited TCP socket accumulation (FIN-WAIT-2 state) during a
djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session
CVE-2026-61593
### Impact The SSE client→server POST endpoints are `@csrf_exempt` and the SSE GET stream endpoint had no Origin check,
LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy
CVE-2025-59953
### Description The LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communicati
djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data
CVE-2026-61595
### Impact `djust.tenants` isolation was enforced only on the HTTP path. The current tenant was stored in `threading.loc
djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler
CVE-2026-61598
### Impact `djust.mixins.model_binding.ModelBindingMixin` provides a default `update_model` event handler and is part of
OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS
CVE-2026-81192
### Summary The `OpenTelemetry.Resources.Host` NuGet package is affected by an untrusted search path vulnerability on m