XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
CVE-2026-33137
### Impact `POST /wikis/{wikiName}` executes a XAR import without performing any authentication or authorization checks
#severity:critical
共收录 1443 条相关情报。
← 返回所有主题Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS...
CVE-2026-9560
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute
IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM...
CVE-2026-8633
IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server
Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron
CVE-2026-46716
Nezha监控系统存在一个严重的权限绕过漏洞（CVE-2026-46716）。该组件是一个开源的服务器监控和运维管理平台，支持管理员（RoleAdmin）和普通成员（RoleMember）两种角色。漏洞位于定时任务相关的API端点（POST
FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory
## Summary `publicPatchHandler` in `backend/http/public.go` joins user-controlled `fromPath` and `toPath` body fields w
YesWiki: Unauthenticated SQL Injection
CVE-2026-46670
### Summary An unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unauthe
An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size...
CVE-2026-9054
An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size would trigger a kernel p
A malicious actor with access to the network could exploit an Improper Input Validation...
CVE-2026-34910
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS
A malicious actor with access to the network could exploit an Improper Access Control...
CVE-2026-34908
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS de
A malicious actor with access to the network could exploit a Path Traversal vulnerability found...
CVE-2026-34909
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to a
A malicious actor with access to the network and high privileges could exploit an Improper Input...
CVE-2026-33000
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabilit
The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing...
CVE-2026-6960
The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
CVE-2026-46703
#### Summary Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI
BoxLite: Permission Bypass Allows Modification of Read-Only Files
CVE-2026-46695
#### Summary Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch O
Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the...
CVE-2026-8134
Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTempl
Twig: PHP code injection via `{% use %}` template name
CVE-2026-46633
### Description `Compiler::string()` escapes `"`, `$`, `\`, NUL and TAB when generating PHP double-quoted string litera
@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators
Impact: @hulumi/policies versions before 1.3.2 only checked exact AWS IAM StringLike/StringEquals condition operator key
A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP...
CVE-2026-9152
A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search ind
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as...
CVE-2026-48172
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild i
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential...
CVE-2026-9139
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web