A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84. Affected is an unknown function of the file /api/v1/users/ of the comp...

CVE-2026-15752

A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84. Affected is a

历史摘要 · 未重新核验 · NVD

Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend

CVE-2026-61549

### Impact A privilege escalation vulnerability affects Woodpecker instances using the **Kubernetes backend**. The pip

历史摘要 · 未重新核验 · GitHub Advisory

Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

### Summary Non-admin operators (role `user`) can set `allow_private: true` on their own managed webhook subscription (

历史摘要 · 未重新核验 · GitHub Advisory

Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

CVE-2026-54629

## Summary Anyquery's `server` mode lacks input sanitization and access control over its built-in SQLite virtual table m

历史摘要 · 未重新核验 · GitHub Advisory

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protoc...

CVE-2026-53633

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode expo

历史摘要 · 未重新核验 · NVD

Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

CVE-2026-54628

## Summary Anyquery's `server` mode does not restrict outbound HTTP requests initiated by its built-in SQLite virtual ta

历史摘要 · 未重新核验 · GitHub Advisory

Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

CVE-2026-53633

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode expo

历史摘要 · 未重新核验 · OSV.dev

n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments

CVE-2026-54052

## Impact In multi-tenant HTTP deployments — where a single n8n-mcp server serves several tenants — the locally stored

历史摘要 · 未重新核验 · GitHub Advisory

Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

CVE-2026-50006

## Summary Anyquery's `server` mode does not disable or restrict native SQLite disk manipulation commands. Unauthenticat

历史摘要 · 未重新核验 · GitHub Advisory

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVE-2026-55052

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

历史摘要 · 未重新核验 · NVD

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

CVE-2026-58279

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

来源摘录 · NVD

Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and Ja...

CVE-2026-60119

Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event cre

历史摘要 · 未重新核验 · NVD

Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidde...

CVE-2026-60118

Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated

历史摘要 · 未重新核验 · NVD

Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` response, proving th...

CVE-2026-52839

Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appoi

历史摘要 · 未重新核验 · NVD

An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload ...

CVE-2026-14504

An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on

历史摘要 · 未重新核验 · NVD

The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing...

CVE-2026-11802

The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versi

历史摘要 · 未重新核验 · GitHub Advisory

SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated...

CVE-2026-44771

SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user

历史摘要 · 未重新核验 · GitHub Advisory

SAP Create Single Payment does not perform necessary authorization checks for an authenticated...

CVE-2026-44770

SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user c

历史摘要 · 未重新核验 · GitHub Advisory

The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() funct...

CVE-2026-11802

FoodBook Lite - Online Food Ordering System插件（WordPress）在1.5.6及之前所有版本中存在授权缺失漏洞。该漏洞存在于注册功能（registration()函数）中，该函数通过wp_aja

历史摘要 · 未重新核验 · NVD

SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the entity resulting in ...

CVE-2026-44771

该漏洞存在于SAP S/4HANA的Draft操作功能中，其根本原因是缺乏对用户权限的充分验证。具体而言，当已认证的低权限用户尝试通过Draft操作访问或修改特定实体数据时，系统未能正确检查用户是否具有相应的访问权限，从而使得受限用户能够获

历史摘要 · 未重新核验 · NVD