共收录 1909 条相关情报。
← 返回所有主题CVE-2026-58432
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Criti
CVE-2026-57886
Cross-repository issue/comment attachment re-linking can expose private attachment content
CVE-2026-58445
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
CVE-2026-58435
Gitea LFS Deploy-Key Privilege Escalation
CVE-2026-58432
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Criti
CVE-2026-57886
Cross-repository issue/comment attachment re-linking can expose private attachment content
CVE-2026-19734
Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus
CVE-2026-28155
Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.
CVE-2026-73616
OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete
CVE-2026-73612
File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete op
CVE-2026-73610
SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the admin
CVE-2026-73606
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that
CVE-2026-73488
Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/
CVE-2026-18945
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confir
CVE-2026-14213
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated em
CVE-2026-18750
vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_functi
CVE-2026-18749
The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coor
CVE-2026-18744
Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying th
CVE-2026-19130
A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific
CVE-2026-72802
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that retu