共收录 1909 条相关情报。
← 返回所有主题CVE-2026-18904
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthori
CVE-2026-55867
### Impact Graylog contains an insecure direct object reference (IDOR) vulnerability in the token revocation endpoint.
CVE-2026-82290
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attac
CVE-2026-82284
Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id
CVE-2026-82283
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users t
CVE-2026-82290
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attac
CVE-2026-82284
Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id
CVE-2026-82283
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users t
CVE-2026-82281
Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and
CVE-2026-82280
Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt
CVE-2026-82271
R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authen
CVE-2026-55067
Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{v
CVE-2026-55066
Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{v
CVE-2026-55065
Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:projec
CVE-2026-54746
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0
CVE-2026-81299
Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.
CVE-2026-79995
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email c
CVE-2026-79615
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question ba
CVE-2026-81817
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue acr
CVE-2026-81668
A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the paren