Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes...
CVE-2026-86185
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScri
#advisory
共收录 23717 条相关情报。
← 返回所有主题Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and...
CVE-2026-86178
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowin
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 -...
CVE-2026-12843
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and...
CVE-2026-86175
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authen
MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler...
CVE-2026-86173
MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unaut
AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that...
CVE-2026-86124
AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces
Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path...
CVE-2026-86169
Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_cod
Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME...
CVE-2026-86121
Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and
Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing...
CVE-2026-86122
Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure ar
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability...
CVE-2026-86119
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/
Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback...
CVE-2026-86117
Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users in
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in...
CVE-2026-86120
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to en
SQL Chat contains four unauthenticated API endpoints that accept client-supplied database...
CVE-2026-86123
SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and exec
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint,...
CVE-2026-86118
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authentic
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without...
CVE-2026-86115
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skippi
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user...
CVE-2026-86114
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to creat
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint,...
CVE-2026-86111
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API...
CVE-2026-86116
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any a
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and...
CVE-2026-86112
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing auth
BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough...
CVE-2026-86113
BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authe