共收录 2104 条相关情报。
← 返回所有主题CVE-2026-85620
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to
CVE-2026-85619
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, all
CVE-2026-85697
Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document vi
CVE-2026-85622
AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the esta
CVE-2026-85620
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to
CVE-2026-85619
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, all
CVE-2026-85597
Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to
CVE-2026-85592
phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddin
CVE-2026-85587
phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to
CVE-2026-85597
Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to
CVE-2026-85592
phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddin
CVE-2026-85587
phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to
CVE-2026-85512
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects
CVE-2026-4644
A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12
CVE-2026-85538
An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite la
CVE-2026-85538
An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite la
CVE-2025-15691
The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before cre
CVE-2026-82302
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrect
CVE-2026-82299
Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Acc
CVE-2026-82298
Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access C