共收录 1909 条相关情报。
← 返回所有主题CVE-2026-85178
Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails t
CVE-2026-85177
CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allo
CVE-2026-75033
A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io
CVE-2026-71404
A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settabl
CVE-2026-71403
A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `userna
CVE-2026-75035
A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user,
CVE-2026-75033
A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io
CVE-2026-71404
A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settabl
CVE-2026-71403
A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `userna
CVE-2026-85211
Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endp
CVE-2026-85177
CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allo
CVE-2026-85173
n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that all
CVE-2026-85105
A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the fi
CVE-2026-80254
Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who ca
CVE-2026-78065
Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-
CVE-2026-78064
Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.2
CVE-2026-85173
n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that all
CVE-2026-73841
### Summary The OpenChoreo API server (`openchoreo-api`) authorized requests to its exec and wirelogs endpoints against
CVE-2026-84672
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions us
CVE-2026-84672
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions us