共收录 1947 条相关情报。
← 返回所有主题CVE-2026-41084
A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstance
CVE-2026-10212
A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr_main_agent of the file astr
CVE-2026-10154
Dolibarr ERP CRM 是一个开源的企业资源规划与客户关系管理系统。该漏洞存在于 23.0.0、23.0.1 和 23.0.2 版本中，位于文件 htdocs/user/messaging.php 的某个未知函数中。攻击者可以通过
CVE-2026-47414
## Summary **Type:** Insecure Direct Object Reference. Five label endpoints — `PATCH /workspaces/{workspace_id}/labels/
CVE-2026-47406
## Summary **Type:** Insecure Direct Object Reference. The dependency endpoints (`POST/GET /workspaces/{workspace_id}/i
CVE-2026-47399
### Summary PraisonAI Platform's workspace-scoped REST routes contain a systemic object-level authorization flaw that a
CVE-2026-47407
## Summary The Platform server exposes resources under `/api/v1/workspaces/{workspace_id}/...` and protects them with a
CVE-2026-47408
## Summary **Type:** Insecure Direct Object Reference. The `GET /workspaces/{workspace_id}/issues/{issue_id}/activity`
CVE-2026-48169
### Summary The PraisonAI Platform API has two authorization failures that together break workspace isolation. The serv
CVE-2026-47266
### Impact Unauthenticated users could modify existing submissions by posting a known or guessed submission ID to `formi
CVE-2026-47231
## Summary `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` o
CVE-2026-47230
## Summary `modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the cross-folder m
CVE-2026-47227
## Summary `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) correspon
CVE-2026-47226
### Summary An authenticated Admidio member with upload rights on **any one folder** can permanently delete files from
CVE-2026-49386
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles
CVE-2026-47266
Formie 是一个 Craft CMS 的插件，用于创建表单。在 2.2.21 和 3.1.26 之前的版本中，存在一个严重漏洞：未经身份验证的攻击者可以通过向 formie/submissions/save-submission 端点发
CVE-2026-49386
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles
CVE-2026-43917
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.19.0 and earlier, the protectedProcedure middleware
CVE-2026-45551
Group-Office is an enterprise customer relationship management and groupware tool. Prior to 26.0.25, 25.0.100, and 6.8.1
CVE-2026-9493
Service Center developed by BankPro E-Service Technology has an Insecure Direct Object Reference vulnerability, allowing