cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State
CVE-2026-63768
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows at
#advisory
共收录 23779 条相关情报。
← 返回所有主题Huginn 2022.08.18 SSRF via ScenarioImport fetch_url Method
CVE-2026-63769
Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport
Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass
CVE-2026-63770
Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthentic
Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header
CVE-2026-63771
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by
FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers
CVE-2026-64619
FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated a
HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint
CVE-2026-63731
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to dir
HyperDX < 2.31.0 SSRF via Webhook Test Endpoint
CVE-2026-63730
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to dir
LimeSurvey SSRF via REST API Survey Template Host Header
CVE-2026-63107
LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey templat
RT: Stored Cross-Site Scripting via insufficient template escaping
CVE-2026-44228
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, conta
RT: Reflected Cross-Site Scripting via URL parameters
CVE-2026-44227
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contai
FreeScout Allows Unauthenticated Access to Legacy Attachment Files
CVE-2026-48812
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's
FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint
CVE-2026-45295
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tr
xrdp: Out-of-bounds read in GCC Conference Create Request CS_SECURITY processing (xrdp_sec_process_mcs_data_CS_SECURITY)
CVE-2026-55639
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Se
xrdp: No authentication required with Xvnc backend on RHEL 9
CVE-2026-55626
xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using
Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance
CVE-2026-46715
Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentica
Chamilo stored XSS via user registration leads to admin account takeover
CVE-2026-39878
Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration fo
WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration
CVE-2026-46555
WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp mes
xrdp: Malformed Confirm Active capability sets cause out-of-bounds reads
CVE-2026-55238
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Co
Webmin 2FA requirement bypass
CVE-2026-42210
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that
Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
CVE-2026-58484
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()`