Medical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to Insecure Permissions, which allows arbitrary user password reset.

CVE-2025-67437

Medical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to Insecure Permissions, which allows a

历史摘要 · 未重新核验 · NVD

Improper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine (VM) or a process to perform unauthorized access to the register space of the JPEG...

CVE-2024-36323

Improper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine (VM) or a process to perf

历史摘要 · 未重新核验 · NVD

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows users to...

CVE-2026-7373

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows users to gain SYSTEM level contro

历史摘要 · 未重新核验 · GitHub Advisory

Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible...

CVE-2025-0040

Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow a

历史摘要 · 未重新核验 · GitHub Advisory

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows users to gain SYSTEM level control of a Windows host. Upon startup the metasploitPostgreSQ...

CVE-2026-7373

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows users to gain SYSTEM level contro

历史摘要 · 未重新核验 · NVD

Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with physical access to read or overwrite the ...

CVE-2025-0040

Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow a

历史摘要 · 未重新核验 · NVD

Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a local attacker to bypass discretionary access control via a malicious file. (Chromi...

CVE-2026-8586

Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a local attacker to bypass d

历史摘要 · 未重新核验 · NVD

Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to bypass discretionary access control via a crafted HT...

CVE-2026-8566

Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacke

历史摘要 · 未重新核验 · NVD

Inappropriate implementation in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin...

CVE-2026-8556

Inappropriate implementation in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who

历史摘要 · 未重新核验 · NVD

Object corruption in Compositing in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a craf...

CVE-2026-8545

Object corruption in Compositing in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised

历史摘要 · 未重新核验 · NVD

hoppscotch is an open source API development ecosystem. The fix for CVE-2026-28215 in version 2026.2.0 addresses the unauthenticated POST /v1/onboarding/config endpoint by check...

CVE-2026-44478

hoppscotch is an open source API development ecosystem. The fix for CVE-2026-28215 in version 2026.2.0 addresses the una

历史摘要 · 未重新核验 · NVD

When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose ac...

CVE-2026-33381

When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few

历史摘要 · 未重新核验 · NVD

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

CVE-2026-33377

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have wr

历史摘要 · 未重新核验 · NVD

Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.

CVE-2026-28374

Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read t

历史摘要 · 未重新核验 · NVD

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the out...

CVE-2026-44007

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code

来源摘录 · NVD

Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server

## Summary If you have the MCP Server ID, you can connect to the MCP server even if you don't have permissions to the s

历史摘要 · 未重新核验 · GitHub Advisory

Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false

CVE-2026-44774

## Summary There is a medium severity vulnerability in Traefik's Kubernetes Gateway API provider that allows a tenant w

历史摘要 · 未重新核验 · GitHub Advisory

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Broken Access Control allows re...

CVE-2026-44352

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and veri

历史摘要 · 未重新核验 · NVD

GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating ...

CVE-2026-44341

GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthentica

历史摘要 · 未重新核验 · NVD

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, an adversary with knowledge of ...

CVE-2026-42158

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and veri

历史摘要 · 未重新核验 · NVD