Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires aut...

CVE-2026-75608

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker

历史摘要 · 未重新核验 · NVD

Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information

CVE-2026-75608

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker

历史摘要 · 未重新核验 · OSV.dev

Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token

CVE-2026-95654

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization de

历史摘要 · 未重新核验 · OSV.dev

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an ope...

CVE-2026-6922

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all ve

历史摘要 · 未重新核验 · NVD

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence...

CVE-2026-62247

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authoriz

历史摘要 · 未重新核验 · NVD

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/mai...

CVE-2026-93954

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSet

历史摘要 · 未重新核验 · NVD

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic...

CVE-2026-1242

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callb

历史摘要 · 未重新核验 · GitHub Advisory

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end...

CVE-2026-92403

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresp

历史摘要 · 未重新核验 · GitHub Advisory

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to th...

CVE-2026-1242

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callb

历史摘要 · 未重新核验 · NVD

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowi...

CVE-2026-92403

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresp

历史摘要 · 未重新核验 · NVD

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive...

CVE-2026-11540

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the fil

历史摘要 · 未重新核验 · GitHub Advisory

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

CVE-2026-11540

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the fil

历史摘要 · 未重新核验 · NVD

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing...

CVE-2026-81178

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public no

历史摘要 · 未重新核验 · NVD

Obot: MCP Registry API readable without authentication

## Summary In affected versions, enabling registry authentication (`OBOT_SERVER_ENABLE_REGISTRY_AUTH=true`) does not ac

历史摘要 · 未重新核验 · GitHub Advisory

Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion

## Summary In affected versions, an unauthenticated attacker could register an OAuth client with an arbitrary external

历史摘要 · 未重新核验 · GitHub Advisory

SysReptor: Anonymous note-share link discloses project member identities and non-shared note activity

CVE-2026-81178

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public no

历史摘要 · 未重新核验 · OSV.dev

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-...

CVE-2026-61672

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in p

历史摘要 · 未重新核验 · NVD

Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement

CVE-2026-61672

## Summary Capsule lets a cluster administrator forbid specific metadata keys that tenant owners must not place on thei

历史摘要 · 未重新核验 · GitHub Advisory

Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement

CVE-2026-61672

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in p

历史摘要 · 未重新核验 · OSV.dev

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-executio...

CVE-2026-93594

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control ru

历史摘要 · 未重新核验 · NVD