共收录 1909 条相关情报。
← 返回所有主题CVE-2026-64969
ATutor is vulnerable to Insecure Direct Object Reference (IDOR) attack in profile picture related endpoints. Any authent
CVE-2026-64961
ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functiona
CVE-2026-77081
n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. Whe
CVE-2026-77079
n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. W
CVE-2026-77073
n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authent
CVE-2026-76397
In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant
CVE-2026-76397
In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant
CVE-2026-76263
In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles coul
CVE-2026-59992
Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azu
CVE-2026-59992
## Summary The production media handler shipped by `next-tinacms-s3` (`createMediaHandler` in `packages/next-tinacms-s3
CVE-2026-53548
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2
CVE-2026-53546
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2
CVE-2026-68559
Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in model
CVE-2026-55694
### Impact An attacker can completely bypass file-name randomization security and without authorization download confide
CVE-2026-55694
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_i
CVE-2026-55482
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/
CVE-2026-18315
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Thr
CVE-2026-62666
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6,
CVE-2026-75951
Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirecto
CVE-2026-75950
Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership