Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib
CVE-2026-100703
Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it
#cwe-200
共收录 1717 条相关情报。
← 返回所有主题Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast
CVE-2026-100687
Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table update
Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import
CVE-2026-100680
Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validat
Grav before 2.0.25 Session Cookie Theft via Twig Sandbox
CVE-2026-100671
Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Tw
Grav before 2.0.25 Sandbox Escape via array Filter
CVE-2026-100668
Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is
SiYuan before v3.8.4 Clipboard Data Disclosure via IPC
CVE-2026-100640
SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderer
Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery
CVE-2026-100632
Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, Live
capgo.app through 12.129.0 Cache Restoration of Deleted Bundles
CVE-2026-100622
capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file rea
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Cont...
CVE-2026-96526
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one
The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed ...
CVE-2026-19708
The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database back
The Team Members WordPress plugin through 9.2 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ...
CVE-2026-11871
The Team Members WordPress plugin through 9.2 does not perform any authorization or visibility check in an unauthentica
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. Thi...
CVE-2026-100379
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App a
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawik...
CVE-2026-100377
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
CVE-2026-61782
### Summary The default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interface
Podman: Malformed Image can trick podman run into leaking host environment variables into the container
CVE-2026-57231
## Summary An container image that contains a environment variable with just a key and no value can trick podman into p
A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an...
CVE-2026-96772
A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /ac
A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106...
CVE-2026-96774
A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. This affects
A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. This affects the function loadCfg of the file /ini/sys_cfg.txt of the ...
CVE-2026-96774
CVE-2026-96774 是披露在 SPON Communications（世邦通信）IP 网络音频设备 XC-9603 上的一处信息泄露漏洞，受影响固件版本为 1.2.3_20181106 Build 107。问题位于设备管理端的“配
A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the a...
CVE-2026-96772
Intelliants Subrion CMS（基于 PHP 的开源内容管理系统，公开发布版本止于 4.2.1，项目已停止维护）被披露存在一处信息泄露漏洞，编号 CVE-2026-96772。问题出现在后端接口 /actions.json?
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain...
CVE-2026-80423
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information