Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass s...

CVE-2026-106199

Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had

历史摘要 · 未重新核验 · NVD

Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffi...

CVE-2026-106195

Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to byp

历史摘要 · 未重新核验 · NVD

Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security ...

CVE-2026-102322

Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute ar

历史摘要 · 未重新核验 · NVD

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an au...

CVE-2026-105864

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before

历史摘要 · 未重新核验 · NVD

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation co...

CVE-2026-105851

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary ve

历史摘要 · 未重新核验 · NVD

Payload: Field access control bypass on auth collections

CVE-2026-105851

## Impact Payload's duplicate operation copies field values from the source document even when a field is hidden, or it

历史摘要 · 未重新核验 · GitHub Advisory

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a rea...

CVE-2026-105805

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions befo

历史摘要 · 未重新核验 · NVD

Payload: Sort queries could expose protected field information

CVE-2026-105805

### Impact Under certain conditions, sorting readable records could reveal limited information about fields the requeste

历史摘要 · 未重新核验 · GitHub Advisory

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization o...

CVE-2026-105797

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions

历史摘要 · 未重新核验 · NVD

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unaut...

CVE-2026-94299

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusti

历史摘要 · 未重新核验 · NVD

A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/...

CVE-2026-105703

A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted elem

历史摘要 · 未重新核验 · NVD

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts...

CVE-2026-105786

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.1

历史摘要 · 未重新核验 · NVD

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

CVE-2026-105750

### Summary When the HTML backend renders pages in a headless browser (`HTMLBackendOptions(render_page=True)`), the `en

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Channel read actions could skip target allowlists

### Summary Channel read actions could skip target allowlists. In affected versions, explicit read targets in Microsoft

历史摘要 · 未重新核验 · GitHub Advisory

vm2: NodeVM custom resolution bypasses external path boundaries

CVE-2026-100721

## Summary At source revision `91034466bfb7f56b95fd48083ec6ca36d058f164` of vm2 3.11.8, an untrusted `NodeVM` guest can

历史摘要 · 未重新核验 · GitHub Advisory

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(rend...

CVE-2026-105750

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

历史摘要 · 未重新核验 · NVD

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determin...

CVE-2026-77226

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run

历史摘要 · 未重新核验 · NVD

A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global re...

CVE-2026-105447

A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuratio

历史摘要 · 未重新核验 · NVD

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but ...

CVE-2026-105687

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team admi

历史摘要 · 未重新核验 · NVD

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissio...

CVE-2026-105684

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread,

历史摘要 · 未重新核验 · NVD