Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108
CVE-2026-81269
Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field version
#advisory
共收录 23717 条相关情报。
← 返回所有主题Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109
CVE-2026-81166
Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Dig
DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112
CVE-2026-81162
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience
Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114
CVE-2026-81164
Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF version
LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115
CVE-2026-81205
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Acti
Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116
CVE-2026-81201
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Men
Kimai before 2.65.0 Authorization Bypass via API Timesheet
CVE-2026-84808
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint
Kimai before 2.65.0 Authentication Bypass via Team Creation
CVE-2026-84807
Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team
Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints
CVE-2026-84806
Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated
Kimai 2.61.0 before 2.63.0 Authentication Bypass via API
CVE-2026-84805
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in
Kimai before 2.65.0 Authorization Bypass via Team Activity API
CVE-2026-84804
Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and custom
Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController
CVE-2026-84802
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::action
Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers
CVE-2026-84801
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-
Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file
CVE-2026-84800
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionR
Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite
CVE-2026-84798
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::
Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate
CVE-2026-84797
Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate()
Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass
CVE-2026-79990 · CVE-2026-84796
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fai
Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance
CVE-2026-84795
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactiva
Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset
CVE-2026-84794
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied.
Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name
CVE-2026-84793
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name fi