Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI s...

CVE-2026-11001

Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced

历史摘要 · 未重新核验 · NVD

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing.

CVE-2026-8644

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing.

历史摘要 · 未重新核验 · NVD

Authentication Bypass by Spoofing vulnerability in AAM Plugin Advanced Access Manager allows URL Encoding. This issue affects Advanced Access Manager: from n/a through 7.1.0.

CVE-2026-42674

Authentication Bypass by Spoofing vulnerability in AAM Plugin Advanced Access Manager allows URL Encoding. This issue a

历史摘要 · 未重新核验 · NVD

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.220, the email processing pipeline in FreeScout's FetchEmails command has two cod...

CVE-2026-47123

FreeScout是一个基于PHP Laravel框架的免费帮助台和共享收件箱系统。在1.8.220之前的版本中，其邮件处理流水线（FetchEmails命令）存在两处代理用户回复识别代码路径，均依赖于In-Reply-To/Referen

历史摘要 · 未重新核验 · NVD

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice mo...

CVE-2026-44649

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

历史摘要 · 未重新核验 · NVD

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's WebSocket control plane trusts client-supplied...

CVE-2026-46414

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Micro

历史摘要 · 未重新核验 · NVD

Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

CVE-2026-45074

`Cas2Handler` builds this `service` parameter from `Request::getSchemeAndHttpHost()`, which reflects the attacker-contro

历史摘要 · 未重新核验 · GitHub Advisory

Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator

CVE-2026-45063

### Description `X509Authenticator` implements client-certificate (mTLS) authentication: the web server validates the c

历史摘要 · 未重新核验 · GitHub Advisory

An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an...

CVE-2026-8676

An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bo

历史摘要 · 未重新核验 · GitHub Advisory

An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bonded device and creating a new bond.

CVE-2026-8676

An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bo

历史摘要 · 未重新核验 · NVD

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Electron configura...

CVE-2026-39309

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bas

历史摘要 · 未重新核验 · NVD

Spoofing issue in the Web Speech component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVE-2026-8963

Spoofing issue in the Web Speech component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

历史摘要 · 未重新核验 · NVD

Spoofing issue in WebExtensions. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVE-2026-8960

Spoofing issue in WebExtensions. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

历史摘要 · 未重新核验 · NVD

Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151.

CVE-2026-8951

Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151.

历史摘要 · 未重新核验 · NVD

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session a...

CVE-2026-7507

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could expl

历史摘要 · 未重新核验 · NVD

@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation

### Summary A critical identity spoofing vulnerability in MCPHub allows any unauthenticated user to impersonate any oth

历史摘要 · 未重新核验 · GitHub Advisory

Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attackers to bypass API rate limi...

CVE-2026-46356

Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic

历史摘要 · 未重新核验 · NVD

Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollment flow allows authentication tokens from any Azure AD t...

CVE-2026-24899

Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollm

历史摘要 · 未重新核验 · NVD

Fleet is open source device management software. Prior to version 4.80.1, Fleet trusted client-supplied IP address headers when determining the source IP for incoming requests. ...

CVE-2026-24000

Fleet is open source device management software. Prior to version 4.80.1, Fleet trusted client-supplied IP address heade

历史摘要 · 未重新核验 · NVD

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single v...

CVE-2026-42602

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in

历史摘要 · 未重新核验 · NVD