Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox
CVE-2026-86197
Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and ad
#advisory
共收录 23717 条相关情报。
← 返回所有主题SiYuan before v3.8.2 Information Disclosure via Attribute-View
CVE-2026-86192
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys end
SiYuan before v3.8.2 Private Attribute View Key Enumeration
CVE-2026-86191
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint t
WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter
CVE-2026-86190
WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user record
WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php
CVE-2026-86189
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to w
AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting
CVE-2026-86188
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to
WWBN AVideo Weak PRNG Password Generation via External Login
CVE-2026-86187
WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing
AVideo API Rate Limit Bypass via Bot User-Agent Header
CVE-2026-86186
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eigh
Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route
CVE-2026-86184
Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows un
CDT before 1.4.5 Out-of-Bounds Read via opposedVertexInd
CVE-2025-15647
CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge in
ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression
CVE-2025-15614
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z arc
Pixelfed through 0.12.9 Unauthorized Story Access via API
CVE-2026-86178
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowin
Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks
CVE-2026-86177
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subus
NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs
CVE-2026-86176
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, S
NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs
CVE-2026-86175
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authen
Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board
CVE-2026-86174
Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. A
MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler
CVE-2026-86173
MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unaut
Axolotl through 0.18.0 Remote Code Execution via Multipack Patching
CVE-2026-86169
Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_cod
Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server
CVE-2026-86122
Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure ar
Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control
CVE-2026-86121
Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and