Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA)...
CVE-2026-68582
Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-col
#severity:critical
共收录 1468 条相关情报。
← 返回所有主题The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all...
CVE-2026-8457
The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and inc
@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0...
CVE-2026-67330
@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through = 1.7.0-beta.0 through <= 1.7.0-beta.9 contai
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java...
CVE-2026-67340
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) b
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE...
CVE-2026-67341
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers...
CVE-2026-67342
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, P
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider...
CVE-2026-67336
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that adve
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form...
CVE-2026-67324
GitPython 3.1.50 fails to recognize joined short-option forms such as -u (the short form of --upload-pack=) when enforci
FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the...
CVE-2026-67305
FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket...
CVE-2026-67292
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/cor
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity...
CVE-2026-66402
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters...
CVE-2026-67289
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controll
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname...
CVE-2026-67293
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability.
FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer...
CVE-2026-67294
FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-si
The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via...
CVE-2026-15964
The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password rese
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node...
CVE-2026-68771
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthentic
Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
CVE-2026-53609
## Summary `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated e
sentence-transformers contains a security control bypass vulnerability that allows attackers to...
CVE-2026-68770
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code e
NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
CVE-2026-52887
## Summary `GET /api/myInAppChannels:list` accepts a structured `filter` query parameter. The handler for the `latestMs
Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform...
CVE-2026-67822
Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The fu