A deployment mode intended to expose only read access to stored data proxies a set of application...
CVE-2026-90448
A deployment mode intended to expose only read access to stored data proxies a set of application programming interface
#advisory
共收录 23661 条相关情报。
← 返回所有主题The application's role-authorization lookup defaults to granting access when a request handler's...
CVE-2026-90450
The application's role-authorization lookup defaults to granting access when a request handler's name is not present in
A web interface reflects a portion of the request URL into a script context and a hyperlink...
CVE-2026-90443
A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate e
A routing rule selects between two different authentication mechanisms for the same downstream...
CVE-2026-90447
A routing rule selects between two different authentication mechanisms for the same downstream service based on the valu
An application programming interface endpoint accepts a user-supplied value and interpolates it...
CVE-2026-90446
An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path o
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames...
CVE-2026-90444
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shel
An interface that accepts file uploads from authenticated users extracts the contents of uploaded...
CVE-2026-90445
An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without valid
ZITADEL: Auto-linking by email: IdP-side email verification is not checked
CVE-2026-56666
### Summary A flaw in the external identity provider handler allows unauthorized account linking to occur under specifi
yayson: Prototype pollution in Store/LegacyStore deserialization
CVE-2026-61534
# Summary `Store`/`LegacyStore` key internal lookup tables by the `type`, `id`, and relationship names from a JSON:API d
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
CVE-2026-59148
## Summary Mockoon's admin API ([`commons-server/src/libs/server/admin-api.ts`](https://github.com/mockoon/mockoon/blob
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
CVE-2026-59149
## Summary A `FILE` response whose `filePath` embeds request data (e.g. `"/srv/public/{{queryParam 'name'}}"`, the docu
FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix
CVE-2026-59973
## Summary The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI exte
Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover
CVE-2026-59151
## SAML Tenant Binding Enables Cross-Tenant Account Takeover ### Summary Prowler's SAML authentication flow trusted th
ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider
CVE-2026-56665
### Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP)
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page...
CVE-2026-81918
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A us
Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags...
CVE-2026-81917
Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block...
CVE-2026-68535
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's vali
Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express ...
CVE-2026-81907
Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function
In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios...
CVE-2026-89772
In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback
In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end_creating...
CVE-2026-89767
In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end_creating() on the casefold-mism