共收录 1909 条相关情报。
← 返回所有主题CVE-2026-61589
### Impact The WebSocket `handle_mount` and `ViewRuntime._build_request` rebuild an `HttpRequest` via `RequestFactory().
CVE-2026-61596
### Impact djust's per-object authorization (`get_object` + `has_object_permission`, ADR-017) was enforced on the WebSoc
CVE-2026-61592
### Impact SSE sessions were keyed solely by a **client-chosen** `session_id` with no binding to the authenticated user
CVE-2026-92810
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allo
CVE-2026-92809
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authentica
CVE-2026-92773
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it
CVE-2026-92765
ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticate
CVE-2026-92752
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in
CVE-2026-92810
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allo
CVE-2026-92809
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authentica
CVE-2026-92773
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it
CVE-2026-92765
ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticate
CVE-2026-63506
Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized a
CVE-2026-20342
A vulnerability in a specific file download API of Cisco Secure FMC Software could allow an authenticated, remote attack
CVE-2026-87113
Tanium addressed an improper access controls vulnerability in Threat Response.
CVE-2026-92716
Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint tha
CVE-2026-92605
IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, a
CVE-2026-47094
SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to
CVE-2026-86465
Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled
CVE-2026-86465
Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled