共收录 1260 条相关情报。
← 返回所有主题CVE-2026-90449
CVE-2026-90449 揭示了某反向代理/网关产品在特定认证模式下存在的访问控制设计缺陷。当系统被配置为某一特定认证模式时，反向代理在处理指向内置第三方管理界面的请求时，会将这些请求直接转发至该第三方界面，而不会先施加网关自身的认证要
CVE-2026-59148
## Summary Mockoon's admin API ([`commons-server/src/libs/server/admin-api.ts`](https://github.com/mockoon/mockoon/blob
CVE-2026-50025
Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mous
CVE-2026-59971
## Summary In SSE/HTTP transport mode, `mysql_mcp_server` constructs `SseServerTransport` without passing `security_set
CVE-2026-53952
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic f
CVE-2026-53952
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic f
CVE-2026-89263
MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauth
CVE-2026-89261
MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication,
CVE-2026-80462
A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain
CVE-2026-89250
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability
CVE-2026-89176
WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerabili
CVE-2026-88018
### Summary `rclone serve s3`'s handler chain, when `--auth-proxy` is configured, is (outermost first): `authPairMiddlew
CVE-2026-88062
## 2. Summary `POST /api/acp/agents` registers a custom ACP agent. The endpoint accepts user-controlled `binary` and `v
CVE-2026-88062
OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier,
CVE-2026-9336
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafte
CVE-2026-88018
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1
CVE-2026-88018
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1
CVE-2026-88285
GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clie
CVE-2026-67593
A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis b
CVE-2026-57967
An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and as