Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query condition...

CVE-2026-120201

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gai

来源摘录 · NVD / GitHub Advisory

Waline login accepts a non-string email as a match-all MongoDB query

## Summary The login endpoint POST /api/token reads the `email` field from the request body without checking its type a

历史摘要 · 未重新核验 · GitHub Advisory

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base...

CVE-2026-118645

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick

来源摘录 · NVD

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoi...

CVE-2026-118641

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in th

来源摘录 · NVD

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it ...

CVE-2026-118581

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-dec

来源摘录 · NVD / OSV.dev

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its typ...

CVE-2026-55369

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the e

来源摘录 · NVD / OSV.dev

Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object...

CVE-2026-116801

Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo

历史摘要 · 未重新核验 · GitHub Advisory

Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead o...

CVE-2026-116801

Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo

历史摘要 · 未重新核验 · NVD

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the...

CVE-2026-57193

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 2

来源摘录 · NVD

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpo...

CVE-2026-55465

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.0

来源摘录 · NVD

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) ac...

CVE-2026-55444

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version

来源摘录 · NVD

A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as que...

CVE-2026-114652

A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can c

来源摘录 · NVD

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0...

CVE-2026-114510

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multip

来源摘录 · NVD

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user who does not hold the "admi...

CVE-2026-76295

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.1

来源摘录 · NVD

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /a...

CVE-2026-114401

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to en

来源摘录 · NVD

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search param...

CVE-2026-114396

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inje

来源摘录 · NVD

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supp...

CVE-2026-113662

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authen

历史摘要 · 未重新核验 · NVD

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into ...

CVE-2026-59962

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, pa

来源摘录 · NVD

Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by IssueListSpaceEndpoi...

CVE-2026-102988

Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthentic

历史摘要 · 未重新核验 · NVD

Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)

CVE-2026-102988

Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthentic

历史摘要 · 未重新核验 · OSV.dev