IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated...
CVE-2026-82885
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing
#cwe-862
共收录 4087 条相关情报。
← 返回所有主题IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive...
CVE-2026-11545
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the admi
Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plu...
CVE-2026-68928
Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.Term
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API.
CVE-2026-82885
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/{id} ...
CVE-2026-76902
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior t
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schem...
CVE-2026-61821
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id()
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing authorization checks.
CVE-2026-11545
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the admi
pg_partman authorization bypass to move child tables between schemas during retention
CVE-2026-61821
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id()
In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an administrator-only po...
CVE-2026-93852
In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project with
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking ...
CVE-2026-85058
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last W
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem...
CVE-2026-77385
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core
Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths au...
CVE-2026-63199
Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trus...
CVE-2026-61550
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC mes
Obot: MCP Registry API readable without authentication
## Summary In affected versions, enabling registry authentication (`OBOT_SERVER_ENABLE_REGISTRY_AUTH=true`) does not ac
io.moquette:moquette-broker has a Missing Authorization issue
CVE-2026-85058
## Summary Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will (Last Will and Testam
Moquette: Missing Authorization in io.moquette:moquette-broker
CVE-2026-85058
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last W
Perses's missing authorization in datasource proxy allows cross-scope secret disclosure
CVE-2026-63199
### Impact The datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret na
Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure
CVE-2026-63199
Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the
Icinga 2: Improper access control for JSON-RPC update certificate messages
CVE-2026-61550
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC mes
Kyoo: Transcoder serves uncataloged files from the media directory
CVE-2026-77385
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core