ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with...
CVE-2026-67356
ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowin
#severity:high
共收录 5387 条相关情报。
← 返回所有主题FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection...
CVE-2026-68580
FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across AL
ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP...
CVE-2026-68578
ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine p
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management...
CVE-2026-68581
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and
ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP...
CVE-2026-67357
ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that
better-auth passkey versions before 1.4.0 contain an insecure direct object reference...
CVE-2025-71400
better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey delet
The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions...
CVE-2026-18352
The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including,
The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up...
CVE-2026-13339
The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows...
CVE-2026-18556
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.
ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ....
CVE-2026-67344
ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYP
guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in...
CVE-2026-67354
guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the
guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the...
CVE-2026-67355
guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain
better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM...
CVE-2026-67331
better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator b
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when...
CVE-2026-67337
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is e
ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1...
CVE-2026-67343
ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing a
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in...
CVE-2026-67328
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker...
CVE-2026-67320
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hard
@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10,...
CVE-2026-67329
@better-auth/stripe versions >= 1.4.11 and = 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organi
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from()....
CVE-2026-67322
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied rem
GitPython before 3.1.50 fails to validate newline characters in the section parameter of...
CVE-2026-67326
GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attac