Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate...
CVE-2026-85878
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a netwo
#severity:critical
共收录 1449 条相关情报。
← 返回所有主题Authorization bypass through user-controlled key in Microsoft Container Registry allows an...
CVE-2026-69865
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elev
Improper neutralization of special elements used in a command ('command injection') in M365...
CVE-2026-85885
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic...
CVE-2026-70200
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorize
Azure Arc Elevation of Privilege Vulnerability
CVE-2026-69399
Azure Arc Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc...
CVE-2026-70009
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attac
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to...
CVE-2026-77903
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a ne
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges...
CVE-2026-83944
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker...
CVE-2026-85889
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges o
A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built...
CVE-2026-93393
A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platf
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
CVE-2026-75827
## Affected versions and vulnerable location - Confirmed on grav core at `78ebfc1` (tag 2.0.13). - Sinks: - `system/s
Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
CVE-2026-75828
## Affected versions and vulnerable location - Confirmed on grav core at `78ebfc1` (tag 2.0.13). - Detector: `system/sr
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
CVE-2026-79752
### Impact The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd(
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the...
CVE-2026-92576
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the
WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored...
CVE-2026-92578
WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a
djust has an authorization bypass on the WebSocket/SSE mount path
CVE-2026-61594
### Impact The live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's `View.dispatch()` chain
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on...
CVE-2026-92805
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in Conf
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity,...
CVE-2026-92787
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypas
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class...
CVE-2026-92785
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist val
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated,...
CVE-2026-76460
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to byp