共收录 1909 条相关情报。
← 返回所有主题CVE-2026-80049
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. Authorizat
CVE-2026-55604
# Cross-Session Data Exposure via Caller-Controlled `session_id` Project / Repository: `arikusi/deepseek-mcp-server`
CVE-2026-48599
### Summary In the HTTP-to-gRPC transcoding layer of the `grpc` Hex package, query-string and request-body parameters c
CVE-2026-78581
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Acce
CVE-2026-77998
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML
CVE-2026-77145
The permission check for the frontend management update flow verified a different event than the one the request went on
CVE-2026-77143
The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modi
CVE-2026-77142
The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for c
CVE-2026-77141
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and
CVE-2026-77140
The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in
CVE-2026-77135
The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target
CVE-2026-77127
The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to se
CVE-2026-56093
The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user
CVE-2026-78466
The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and
CVE-2026-10630
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress
CVE-2026-5006
A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may
CVE-2026-71507
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account w
CVE-2026-71505
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site accou
CVE-2026-5006
A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may
CVE-2026-54050
### Summary The Sakai REST API endpoint `DELETE /api/users/{userId}/profile/image` does not verify that the requesting