A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory...
CVE-2026-19568
A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A mal
#severity:high
共收录 5383 条相关情报。
← 返回所有主题A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds...
CVE-2026-16783
A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A
RansomLook contains multiple weaknesses in its authentication endpoint that allow an...
CVE-2026-78551
RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to
RansomLook created its Flask session-signing key without explicitly restricting the file...
CVE-2026-78553
RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key fil
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report...
CVE-2026-71509
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint t
A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer...
CVE-2026-78541
A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenti
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API...
CVE-2026-71508
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API...
CVE-2026-71507
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account w
Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows...
CVE-2026-71510
Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers
Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API...
CVE-2026-71511
Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticate
Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability....
CVE-2026-61419
Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability. A low privileged attac
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API...
CVE-2026-71506
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that al
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API...
CVE-2026-71504
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers wi
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API...
CVE-2026-71505
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site accou
3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation
CVE-2026-55477
# Summary An authenticated administrator can abuse the database import functionality to achieve arbitrary file write on
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
CVE-2026-54623
### Summary The `move_plugin` admin endpoint does not prevent a plugin from being reparented under itself or one of it
postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service
A malicious, compromised, or man-in-the-middle server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration cou
Sakai Conversations has a Stored XSS Issue
CVE-2026-54049
### Summary The Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend ren
Hi.Events validates a webhook destination only when it is registered, never when it is used....
CVE-2026-76838
Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backen
An unauthenticated OS command injection vulnerability exists in the parental control...
CVE-2026-9254
An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, B