Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type
CVE-2026-82468
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content
#advisory
共收录 23717 条相关情报。
← 返回所有主题Rodauth before 2.47.0 Open Redirect via Return-to Path
CVE-2026-82467
Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested
Rodauth before 2.46.0 Authentication Bypass via webauthn_login
CVE-2026-82466
Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in
pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest
CVE-2026-82465
pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.val
pac4j-core before 6.5.6 Open Redirect via Backslash Logout
CVE-2026-82464
pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-p
pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check
CVE-2026-82463
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the
pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution
CVE-2026-82462
pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token vali
pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token
CVE-2026-82461
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak
Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown
CVE-2026-82460
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoint
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions...
CVE-2026-82456
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller c
su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol...
CVE-2026-82457
su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t an
The cohttp package before 6.3.0 for OCaml allows directory traversal.
CVE-2026-82481
The cohttp package before 6.3.0 for OCaml allows directory traversal.
In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers...
CVE-2026-82477
In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal netw
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where...
CVE-2026-82452
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lac
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication...
CVE-2026-82454
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in toke
Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking...
CVE-2026-82451
Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem...
CVE-2026-82455
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-exi
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in...
CVE-2026-82453
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attacker
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that...
CVE-2026-82448
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check...
CVE-2026-82449
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrep