共收录 1909 条相关情报。
← 返回所有主题CVE-2026-89063
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Obje
CVE-2026-88065
`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions
CVE-2026-88065
`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions
CVE-2026-18423
Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search p
CVE-2026-79409
An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and th
CVE-2026-54050
Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/p
CVE-2026-91984
Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task'
CVE-2026-91933
Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authen
CVE-2026-55178
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.
CVE-2026-91993
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoin
CVE-2026-52826
Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/{id}/rate/
CVE-2026-52821
Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/{p
CVE-2026-52820
Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets
CVE-2026-46498
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied
CVE-2026-91846
Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whethe
CVE-2026-89141
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Obje
CVE-2026-90858
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Af
CVE-2026-91773
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users
CVE-2026-91770
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated e
CVE-2026-54258
ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and