Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint
CVE-2026-101056
Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID.
#cwe-863
共收录 2104 条相关情报。
← 返回所有主题Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope
CVE-2026-101048
Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API...
CVE-2026-100869
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing cust
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers w...
CVE-2026-100869
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing cust
Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
CVE-2026-100869
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing cust
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When...
CVE-2026-100721
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `
A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route...
CVE-2026-100744
A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Htt
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: '...
CVE-2026-100721
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `
Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the...
CVE-2026-100704
Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyvern
Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator never reads the spec.images and s...
CVE-2026-100704
Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyvern
Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in ...
CVE-2026-100685
Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enume
SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard (util.IsForbiddenAbsPath(), invoked from ...
CVE-2026-100633
SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensi
Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that the newly assigned r...
CVE-2026-100629
Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id
capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply app...
CVE-2026-100628
capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API key
Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to insert" a...
CVE-2026-100623
Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's
capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an organiz...
CVE-2026-100616
capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security
capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of publication), the `...
CVE-2026-100613
capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current r
ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its origi...
CVE-2026-100604
ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an orga
Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass
CVE-2026-100704
Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyvern
Budibase before 3.45.0 Information Disclosure via Chat Links
CVE-2026-100685
Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enume