共收录 1947 条相关情报。
← 返回所有主题CVE-2026-43883
WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/PayPalYPT/agreementCancel.jso
CVE-2026-38568
HireFlow v1.2 is vulnerable to Incorrect Access Control. The application does not enforce object-level authorization on
CVE-2026-33052
MantisBT allows a low-privileged authenticated user having *add_profile_threshold* to create a global profile despite no
CVE-2026-33356
In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to gl
CVE-2026-42609
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows
CVE-2026-8196
CVE-2026-8196 是影响 JeecgBoot 3.9.1 版本的一个授权绕过漏洞。该漏洞存在于 mLogin 端点的 LoginController.java 文件中，具体位于 jeecg-module-system/jeecg-
CVE-2026-42456
AnythingLLM 是一个将内容片段转化为 LLM 聊天参考上下文的应用程序。在 1.12.1 版本之前，GET /api/workspace/:slug/tts/:chatId 接口存在不安全的直接对象引用（IDOR）漏洞。该路由仅验
CVE-2026-42291
SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version 2026.27, the endpoin
CVE-2026-42205
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulne
CVE-2026-44400
MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile
CVE-2026-44400
MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile
CVE-2026-42279
solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entr
CVE-2026-42278
UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the UltraDAG StateEngine implementation of Sm
CVE-2026-42277
Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the GET /chat/file/{file_id} endpoint all
CVE-2026-42276
Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the POST /chat/stop-chat-session/{chat_se
CVE-2026-41906
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.214, the Change
CVE-2026-27329
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incor
CVE-2026-40981
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the co
CVE-2026-44544
## Summary An attacker with push access to gittuf's Reference State Log (RSL) can roll back the current policy to any p
CVE-2026-44426
## Summary `GET /api/namespaces/:tenant` returns the full namespace object — including the members list (user IDs, e-mai