AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API
CVE-2026-85619
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, all
#advisory
共收录 23717 条相关情报。
← 返回所有主题ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives
CVE-2026-85618
ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users t
Douyin_TikTok_Download_API 4.1.2 SSRF via url parameter
CVE-2026-85608
Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /
Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Router
CVE-2026-85607
Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.up
Slink before 1.12.3 Missing Authorization on Image Comment Endpoints
CVE-2026-85605
Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to
valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds
CVE-2026-85522
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function creat
CVE-2026-85649
CVE-2026-85649
(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the A
StackStorm st2 API Key auth.py privileges management
CVE-2026-85514
A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st
StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management
CVE-2026-85513
A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_us
Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it ...
CVE-2026-82309
Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a fo
snipe-it before 8.6.3 Authorization Bypass via Bulk Delete
CVE-2026-85617
snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allow
Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance
CVE-2026-85616
Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when
Grav before 2.0.19 Remote Code Execution via sort filter
CVE-2026-85604
Grav before 2.0.19 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter.
Grav Admin before 2.0.20 Cross-Site Scripting via marked.js
CVE-2026-85601
Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@ht
Grav Admin before 2.0.21 Stored XSS via username
CVE-2026-85600
Grav Admin (getgrav/grav-plugin-admin2) versions , ", or ', allowing an attacker to register a username containing an HT
Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages
CVE-2026-85598
Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page e
Traefik before v2.11.55 mTLS Bypass via TLS Option Conflict
CVE-2026-85597
Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to
Traefik v3.7 Authentication Bypass via TLS Option Conflict
CVE-2026-85596
Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The
Traefik before v2.11.55 Authentication Bypass via digestAuth
CVE-2026-85595
Traefik versions before v2.11.55 contain an authentication bypass vulnerability in the digestAuth middleware where unkno
Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware
CVE-2026-85594
Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/s