The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets.

CVE-2026-62415

The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media asset

历史摘要 · 未重新核验 · NVD

The Joomla extension Events Booking prior version 5.8.0 did by default allow unauthenticated users to upload media assets.

CVE-2026-60024

The Joomla extension Events Booking prior version 5.8.0 did by default allow unauthenticated users to upload media asset

历史摘要 · 未重新核验 · NVD

Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod...

CVE-2026-62185

Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access r

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

CVE-2026-52824

### Summary The official Kimai Docker image ships with `APP_SECRET=change_this_to_something_unique` as the default envi

历史摘要 · 未重新核验 · GitHub Advisory

Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other Argo APIs. Attackers can exploit thi...

CVE-2026-62185

Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access r

历史摘要 · 未重新核验 · NVD

Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE

CVE-2026-15416 · CVE-2026-62185

Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access r

历史摘要 · 未重新核验 · OSV.dev

PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the...

CVE-2026-61439

PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults

历史摘要 · 未重新核验 · GitHub Advisory

PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass...

CVE-2026-61439

PraisonAI 版本 4.6.78 之前存在提示注入防御配置错误。默认情况下，阻止阈值设置为严重（CRITICAL）级别，导致高（HIGH）严重级别的威胁可以绕过。攻击者可以提交单向量提示注入攻击，例如指令覆盖或金融操控，这些攻击会触发

历史摘要 · 未重新核验 · NVD

PraisonAI before 4.6.78 Prompt Injection Defense Bypass

CVE-2026-61439

PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults

历史摘要 · 未重新核验 · OSV.dev

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

CVE-2026-54158

### Summary The attribute-view (database) cell renderer `genAVValueHTML` interpolates cell content raw in four of its b

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

CVE-2026-54067

### Summary A CSS snippet body containing `` breaks out of its surrounding `` tag when `renderSnippet()` interpolates i

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894

CVE-2026-54066

## Summary The patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the `/export/` route but

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application sh...

CVE-2026-54800

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base syst

历史摘要 · 未重新核验 · NVD

Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

### Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` at a ve

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole obje...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD

来源摘录 · NVD

Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute...

CVE-2026-56285

Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded defaul

历史摘要 · 未重新核验 · NVD

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the def...

CVE-2026-46386

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docke

历史摘要 · 未重新核验 · NVD

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default ...

CVE-2026-55454

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-pr

历史摘要 · 未重新核验 · NVD

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell renderer genAVValueHTML interpolates cell content raw in four o...

CVE-2026-54158

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell render

历史摘要 · 未重新核验 · NVD

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, CSS snippet body containing </style> breaks out of its surrounding <style> tag when renderSnippet(...

CVE-2026-54067

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, CSS snippet body containing breaks out o

历史摘要 · 未重新核验 · NVD