SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages...
CVE-2026-101092
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish r
#cwe-200
共收录 1717 条相关情报。
← 返回所有主题A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unknown function of the component Básico Page. Such manipulation leads to inclusio...
CVE-2026-101265
A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unknown function of the c
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized da...
CVE-2026-101092
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish r
A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the...
CVE-2026-101146
A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.cre
A vulnerability was found in Eleveo Quality Management 9.7.0. Affected by this issue is some...
CVE-2026-101143
A vulnerability was found in Eleveo Quality Management 9.7.0. Affected by this issue is some unknown functionality of th
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS t...
CVE-2026-102267
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because red
A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom.scorecard.webui.S...
CVE-2026-101146
A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.cre
A vulnerability was found in Eleveo Quality Management 9.7.0. Affected by this issue is some unknown functionality of the file /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scor...
CVE-2026-101143
A vulnerability was found in Eleveo Quality Management 9.7.0. Affected by this issue is some unknown functionality of th
A security vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x. Impacted is an unknown function in the library encryptionhelper.dll. Such manipulation leads to informatio...
CVE-2026-101083
A security vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x. Impacted is an unknown function in the library en
A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability is the function GET_STATUS of the component TCP Service. The manipulation of...
CVE-2026-101055
A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability is the function GET
Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller conf...
CVE-2026-82385
Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read
Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files
CVE-2026-82385
Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read
A flaw has been found in Eyeplus 57.0.0.0308. The impacted element is an unknown function of the file /snapshot of the component p2pcam Service. This manipulation causes informa...
CVE-2026-100907
A flaw has been found in Eyeplus 57.0.0.0308. The impacted element is an unknown function of the file /snapshot of the c
A vulnerability was detected in Eyeplus 57.0.0.0308. The affected element is the function GetUsers of the file /onvif/Device of the component ONVIF. The manipulation results in ...
CVE-2026-100906
A vulnerability was detected in Eyeplus 57.0.0.0308. The affected element is the function GetUsers of the file /onvif/De
The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital...
CVE-2026-92995
The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handle
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capab...
CVE-2026-82841
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/...
CVE-2026-100851
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint
http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a...
CVE-2026-100725
http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (clien
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0...
CVE-2026-100723
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength ==
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with only View Station P...
CVE-2026-100851
AzuraCast 是一个开源的网络广播电台管理平台。CVE-2026-100851 指出，在 0.23.8 版本之前，其 GET /api/station/{id}/vue/profile 接口存在访问控制不当（Broken Access