Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.
CVE-2026-72900
Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.
#cwe-862
共收录 4228 条相关情报。
← 返回所有主题Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/r...
CVE-2026-72737
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because Discourse...
CVE-2026-72732
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_temp
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from ...
CVE-2026-72723
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.ano
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate...
CVE-2026-72722
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path t...
CVE-2026-47754
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19
In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conver...
CVE-2026-72759
In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to w...
CVE-2026-71959
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /c
When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desk...
CVE-2026-15060
When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running o
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and ...
CVE-2026-72692
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote att
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthent...
CVE-2026-19404
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operati
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the...
CVE-2026-19350
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/in
A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown...
CVE-2026-19345
A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/Up
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulat...
CVE-2026-19350
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/in
A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument task...
CVE-2026-19345
A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/Up
Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at `GET /api/v1/subscription/stripe/callback?ch...
CVE-2026-47127
Ghostfolio 是一款开源财富管理软件。在 3.4.0 版本之前，其 Stripe 结账成功回调接口 `GET /api/v1/subscription/stripe/callback?checkoutSessionId=<id>`
Kata Containers is an open source implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnerable to ...
CVE-2026-64676
Kata Containers 是一个开源实现，通过轻量级虚拟机提供容器级隔离。在 4.0.0 之前的版本中，kata-agent 组件存在机密访客内存管理中的授权绕过漏洞。在机密容器（CoCo）部署场景下，kata-agent 依赖基于
PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The servi...
CVE-2026-48169
PraisonAI 是一个多智能体团队系统，其 Platform API 在 0.1.4 版本之前存在两个授权缺陷，二者叠加会彻底破坏工作区隔离。第一个缺陷位于 issues 和 projects 的服务层：该层执行全局主键查询时未校验工作
Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial...
CVE-2026-19017
Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read whe
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links (NFC or QR) delivered thr...
CVE-2026-66061
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS