Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code...
CVE-2026-50517
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
#severity:critical
共收录 1468 条相关情报。
← 返回所有主题Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges...
CVE-2026-62825
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.
Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate...
CVE-2026-56160
Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a netwo
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary...
CVE-2026-42933
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information...
CVE-2026-28698
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized contr
9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default...
CVE-2026-63732
9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authent
Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution...
CVE-2025-71389
Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a versio
Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting ...
CVE-2024-58353
Cal.com (repository calcom/cal.diy) in versions ). Booking question (form field) labels are rendered via React's dangero
Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting...
CVE-2024-58355
Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking
The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate...
CVE-2026-49035
The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execu
The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow...
CVE-2026-63359
The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated att
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass...
CVE-2026-15981
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, a
h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API...
CVE-2026-65700
h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthentica
SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal...
CVE-2026-65701
SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inf
Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote...
CVE-2026-6516
Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2...
CVE-2026-65761
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validat
Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in...
CVE-2026-65760
Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
### Impact `next-auth` (Auth.js) v5 applications that gate access by checking only for the **existence** of the `auth`
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
## Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address **befor
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware ...
CVE-2026-60372
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Third