A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application...
CVE-2026-76438
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an
#cwe-863
共收录 2104 条相关情报。
← 返回所有主题cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction...
CVE-2026-92801
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactiv
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions,...
CVE-2026-92793
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated use
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes...
CVE-2026-92788
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules,...
CVE-2026-92776
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to a
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections,...
CVE-2026-92782
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated a
Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers,...
CVE-2026-92774
Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based acce
OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's...
CVE-2026-92764
OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returni
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records...
CVE-2026-92771
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing
Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription...
CVE-2026-92760
Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restr
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands b...
CVE-2026-92801
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactiv
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query param...
CVE-2026-92793
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated use
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predicta...
CVE-2026-92788
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's
Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the l...
CVE-2026-92774
Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based acce
Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with aut...
CVE-2026-92760
Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restr
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alt...
CVE-2026-76438
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an
When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification...
CVE-2026-73469
When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain
On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentia...
CVE-2026-19640
On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interfa
A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially alt...
CVE-2026-27552
A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload end
GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have ...
CVE-2026-79708
GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3