Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links...
CVE-2026-80196
Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after passwo
#advisory
共收录 23717 条相关情报。
← 返回所有主题Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows...
CVE-2026-80199
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers t
Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox,...
CVE-2026-80201
Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call
Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet...
CVE-2026-80197
Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(),...
CVE-2026-80202
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions
Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController...
CVE-2026-80194
Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_pro
Socket.IO: Engine.IO WebTransport SID DoS
CVE-2026-59724
### Impact Engine.IO servers with **WebTransport enabled** are vulnerable to a remotely triggerable denial of service.
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
CVE-2026-81888
### Summary The built-in social login providers accept an OAuth callback even when the `state` value is absent on both
elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
CVE-2026-81889
[poc.zip](https://github.com/user-attachments/files/30352020/poc.zip) ## Summary elFinder 2.1.69 is vulnerable to a Ser
TYPO3 CMS - Unrestricted File Upload in Form Framework
CVE-2026-15305
### Problem Users were able to upload files with arbitrary MIME types to forms using _FileUpload_ or _ImageUpload_ eleme
Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence
CVE-2026-52730
Xibo is an open source digital signage platform with a web content management system and Windows display player software
oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs
CVE-2026-53507
oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request
Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion
CVE-2026-14696
When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), eth_bridge_input_process() in subsys/net/l2/ethernet/bri
oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)
CVE-2026-53508
oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.
Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise
CVE-2026-53553
Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability ex
Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers
CVE-2026-53552
Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile,
FLVMeta AMF Object Parsing amf.c amf_object_get null pointer dereference
CVE-2026-82821
A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the function amf_object_get of
Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser
CVE-2026-14368
The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into
A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This...
CVE-2026-82811
A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function o
A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is...
CVE-2026-82816
A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality