Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels...

CVE-2026-72719

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transf

历史摘要 · 未重新核验 · NVD

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user...

CVE-2026-17598

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when

历史摘要 · 未重新核验 · GitHub Advisory

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the adminis...

CVE-2026-17598

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when

历史摘要 · 未重新核验 · NVD

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling. Craf

历史摘要 · 未重新核验 · GitHub Advisory

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could hav...

CVE-2026-12436

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 1

历史摘要 · 未重新核验 · NVD

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id, name, value}]` array from the submitter and stores it ve...

CVE-2026-63428

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id,

历史摘要 · 未重新核验 · NVD

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated rol...

CVE-2026-63102

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitr

历史摘要 · 未重新核验 · NVD

HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set

CVE-2026-63428

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id,

历史摘要 · 未重新核验 · OSV.dev

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing...

CVE-2026-56679

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body t

历史摘要 · 未重新核验 · NVD

9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

CVE-2026-56679

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body t

历史摘要 · 未重新核验 · OSV.dev

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records usi...

CVE-2026-59888

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From

历史摘要 · 未重新核验 · NVD

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in...

CVE-2026-55809

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance f

历史摘要 · 未重新核验 · GitHub Advisory

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in...

CVE-2026-55804

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow

历史摘要 · 未重新核验 · GitHub Advisory

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in...

CVE-2026-55810

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphin

历史摘要 · 未重新核验 · GitHub Advisory

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in...

CVE-2026-15083

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Cond

历史摘要 · 未重新核验 · GitHub Advisory

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in...

CVE-2026-55803

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow

历史摘要 · 未重新核验 · GitHub Advisory

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in...

CVE-2026-13244

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Ma

历史摘要 · 未重新核验 · GitHub Advisory

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in...

CVE-2026-12535

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field a

历史摘要 · 未重新核验 · GitHub Advisory

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js G...

CVE-2026-55810

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphin

历史摘要 · 未重新核验 · NVD

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag att...

CVE-2026-55809

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance f

历史摘要 · 未重新核验 · NVD