LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows...
CVE-2026-105129
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only s
#cwe-863
共收录 2104 条相关情报。
← 返回所有主题LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through th...
CVE-2026-105129
CVE-2026-105129 是披露于 LaraDashboard 1.4.8 之前版本的授权校验缺陷（不当授权 / 访问控制不足，CWE-863 类问题）。LaraDashboard 是构建在 Laravel 之上的后台管理面板组件，其
In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal...
CVE-2026-71890
In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle
In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, coun...
CVE-2026-71890
In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle
In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing cert...
CVE-2026-71886
In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or tr
MLS external commit can remove an arbitrary group member
CVE-2026-71890
In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle
OpenPGP certification accepted from a subkey without certification authority
CVE-2026-71886
In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or tr
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head...
CVE-2026-105090
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enfor
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace...
CVE-2026-105090
Formbricks 是一套开源问卷／调查平台，其 5.4.4 之前的 5.x 版本以及 6.0.1 之前的 6.x 版本存在存储型跨站脚本（stored XSS）漏洞，根因是权限校验缺失。产品在调查（survey）级别提供了 Custom
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langg...
CVE-2026-104873
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs fro
Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitr...
CVE-2026-103626
Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker le
YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless ...
CVE-2026-104443
YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user
YesWiki before 4.6.7 Scope Bypass via Triples Delete API
CVE-2026-104443
YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user
Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE sign...
CVE-2026-104480
Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecogn
A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component P...
CVE-2026-104054
A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooki
calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization
CVE-2026-104054
A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooki
RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object)...
CVE-2026-82358
RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src
RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' that fails to properly validate write p...
CVE-2026-82358
RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src
SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block
CVE-2026-73606
### Summary `/api/block/getRefIDs` filters its results for reader roles through a helper that checks only the visibilit
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
CVE-2026-92951
### Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It