DataEase before 2.10.26 Access Control Bypass via Share Tickets
CVE-2026-82879
DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to th
#advisory
共收录 23717 条相关情报。
← 返回所有主题DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints
CVE-2026-82878
DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, an
ILIAS before 9.22 Arbitrary File Read via SOAP addFile
CVE-2026-82877
ILIAS versions before 9.22, 10.0 through 10.9, and 11.0 through 11.2 contain an arbitrary file read vulnerability in the
diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload
CVE-2026-82679
A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the
diem-project diem Administrative Console actions.class.php executeCommand os command injection
CVE-2026-82678
A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of
valkey-io valkey Module Timer module.c moduleTimerHandler double free
CVE-2026-82677
A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/mo
klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service
CVE-2026-82669
A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of
klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection
CVE-2026-82668
A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the functio
@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG
CVE-2026-82868
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-sup
@pdfme/schemas before 5.5.9 Cross-Site Scripting via Select
CVE-2026-82867
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sani
@pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch
CVE-2026-82866
@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetc
pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label
CVE-2026-82865
pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that a
pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb
CVE-2026-82864
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer()
@hulumi/baseline before 1.3.2 CloudTrail Selector Tampering Detection
CVE-2026-82863
@hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging
Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files
CVE-2026-82862
Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to sh
@hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypass
CVE-2026-82861
@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoof
@hulumi/policies before 1.3.2 Admin Policy Bypass
CVE-2026-82860
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrat
hulumi before v1.3.2 SCP Template Tag-on-Create Bypass
CVE-2026-82859
hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role p
@hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance
CVE-2026-82858
@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, a
hulumi before v1.3.2 Privilege Escalation via IAM Policy
CVE-2026-82857
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that all