Payload: Insufficient Access Control in Stripe REST Proxy
CVE-2026-105848
## Impact An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy. **Y
#cwe-749
共收录 73 条相关情报。
← 返回所有主题Joyland AI app allows an attacker with shared network access to inject JavaScript into content...
CVE-2026-102667
Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Withou
Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the ...
CVE-2026-102667
Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Withou
Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute ar...
CVE-2026-96430
Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2
Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch pa...
CVE-2026-86157
Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low
Exposed dangerous function lead to privilege escalation via gRPC server.
CVE-2026-25255
Exposed dangerous function lead to privilege escalation via gRPC server.
MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which expo...
CVE-2026-77521
MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skil
Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plu...
CVE-2026-68928
Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.Term
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults secu...
CVE-2026-61793
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthen
A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with...
CVE-2026-20293
A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-ba
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script ...
CVE-2026-86711
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-n
electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge
CVE-2026-86711
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-n
Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief...
CVE-2026-75810
Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief system stall by bypassing
Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief system stall by bypassing driver authentication and sending requests to trigger sy...
CVE-2026-75810
Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief system stall by bypassing
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on...
CVE-2026-18263
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulne
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on...
CVE-2026-18262
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulne
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on...
CVE-2026-13121
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulne
GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates
CVE-2024-45747
### Summary A server-side template injection (SSTI) vulnerability exist that allows an authenticated administrator to up
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a ...
CVE-2026-52877
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the op
Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-down...
CVE-2026-48056
Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 impro