ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path...
CVE-2026-48364
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that c
#severity:high
共收录 5441 条相关情报。
← 返回所有主题ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path...
CVE-2026-48363
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that c
OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent...
CVE-2026-26396
OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/applicati
LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request...
CVE-2025-45869
LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (SSRF). An unauthenti
Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated...
CVE-2026-49972
Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remo
DIRAC: SQL injection and lack of access control in PilotManager service
### Details A number of the functions in PilotManager pass parameters directly through to the database layer, which then
DIRAC: Pilot code downloaded over unverified HTTPS connection
CVE-2026-61668
### Summary The second stage pilot (pilot.tar) is downloaded by the initial wrapper script without any verification of t
Apollo ConfigService access key authentication bypass via raw config file appId parsing
CVE-2026-59955
### Summary Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey / management key
Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching
CVE-2026-59954
### Summary Apollo ConfigService may allow unauthorized access to configuration data when AccessKey / management key aut
NukeViet: Pre-authentication SSRF via X-Forwarded-Host
CVE-2026-55372
## Summary An unauthenticated attacker can coerce the server into issuing HTTP requests to an attacker-chosen host by s
NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function
CVE-2026-54065
## Summary Path Traversal to Arbitrary File Deletion in the Edit Comment admin function. An authenticated administrator
NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module
CVE-2026-54064
## Summary Two filter-bypass techniques in `NukeViet\Core\Request::filterAttr()` and `NukeViet\Core\Request::unhtmlenti
NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-49259
## Summary A stored cross-site scripting (XSS) vulnerability exists in NukeViet CMS versions 4.x through 4.5.08. A low-
NukeViet: Unauthenticated Reflected XSS in Comment Module
CVE-2026-48118
## Summary Reflected XSS in the Comment module via the `status_comment` URL parameter. The parameter accepts attacker-c
Decidim: JWT-backed authentication can be replayed across organizations
CVE-2026-45414
## Description A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL `parti
Decidim: Verification documents can be downloaded through reusable links
CVE-2026-45378
## Description Scanned identity-document images provided by participants and shown in the verification admin workflow a
A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this...
CVE-2026-15511
A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function sy
A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected...
CVE-2026-15506
A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected element is an unknown func
Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker...
CVE-2026-58596
Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges o
Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO...
CVE-2026-56313
Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that al