Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator...
CVE-2026-92594
Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fi
#cwe-200
共收录 1721 条相关情报。
← 返回所有主题djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client
CVE-2026-61588
### Impact When a Django `Model` instance is assigned to a **public** view attribute, djust serialized it to the client
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in...
CVE-2026-92811
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints,
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner...
CVE-2026-92770
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credenti
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security revie...
CVE-2026-20360
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering t
Tanium addressed an information disclosure vulnerability in Discover.
CVE-2026-87076
Tanium addressed an information disclosure vulnerability in Discover.
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnost...
CVE-2026-81870
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider em
`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability...
CVE-2026-88065
`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions
`tts-be` application has a Broken Access Control vulnerability
CVE-2026-88065
`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions
A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to view some system memory contents. Successful exploitation could...
CVE-2026-76707
A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to view s
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive information. Successful ...
CVE-2026-76706
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated rem
A vulnerability in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways could allow a remote attacker authenticated with low privileges to access sen...
CVE-2026-76697
A vulnerability in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways could allow a remote
A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to obtain limited information from memory and disrupt the normal o...
CVE-2026-76692
A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to obtain
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect ...
CVE-2026-69212
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware stri
In Cellular Modem, there is a possible information disclosure due to a logic error in the code. This could lead to remote code execution with no additional execution privileges ...
CVE-2026-56882
In Cellular Modem, there is a possible information disclosure due to a logic error in the code. This could lead to remot
In VPU, there is a possible information dislclosure due to a logic error in the code. This could lead to local information disclosure with System execution privileges needed. Us...
CVE-2026-0197
In VPU, there is a possible information dislclosure due to a logic error in the code. This could lead to local informati
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL policy in s...
CVE-2026-54689
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through
Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can...
CVE-2026-91992
Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused acr
Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret crede...
CVE-2026-91985
Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allo
Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users ...
CVE-2026-91981
Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers