Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
CVE-2026-58494
## Summary Wasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite tha
#cwe-863
共收录 2098 条相关情报。
← 返回所有主题MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENT...
CVE-2026-97380
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allow...
CVE-2026-18256
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict p
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest...
CVE-2026-18223
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invite
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an aut...
CVE-2026-18551
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combin
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE...
CVE-2026-111369
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson rout
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in...
CVE-2026-111352
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restrict
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows...
CVE-2026-111332
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep sh
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
CVE-2026-102832
## Description A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the
SFTPGo source-side file-pattern filter bypass during copy operations
CVE-2026-103028
### Summary File pattern filters (`denied_patterns` / `allowed_patterns`) were evaluated on the destination of a copy o
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
CVE-2026-77459
### Impact Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers dest
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verif...
CVE-2026-55103
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, i
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as...
CVE-2026-110904
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostr
Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared...
CVE-2026-110873
Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwr
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to...
CVE-2026-110867
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environmen
n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow...
CVE-2026-110844
n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credential
n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node...
CVE-2026-110850
n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an edit
An improper access control vulnerability has been identified in the SonicWall Network Security...
CVE-2026-96540
An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in
The Ignition Perspective module does not properly validate session privileges when determining...
CVE-2026-92817
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An
Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a...
CVE-2026-110144
Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potent