OpenAM has LDAP Injection via `_queryId` Parameter
CVE-2026-41573
OpenAM (Open Identity Platform) is an open-source IAM platform providing SSO, OAuth2, SAML, and OpenID Connect capabilit
#severity:high
共收录 5499 条相关情报。
← 返回所有主题ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)
CVE-2025-67303
### Impact An **Unprotected Alternate Channel (CWE-420)** vulnerability was discovered in ComfyUI-Manager versions prio
AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
CVE-2026-33692
## Vulnerability Details **CWE**: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Direc
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free...
CVE-2026-56109
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def()
The public dashboard query endpoint does not limit request body size before processing, allowing...
CVE-2026-42127
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attacke
IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0...
CVE-2026-8646
IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 ar
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0...
CVE-2026-9071
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 a
IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server and IBM WebSphere Application...
CVE-2026-8858
IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerab
IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server, and IBM WebSphere Application...
CVE-2026-9072
IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server, and IBM WebSphere Application Server Liberty - when usin
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF)...
CVE-2026-9006
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy co
Incorrect caching of authentication between different polkit methods in qSnapper before version 1...
CVE-2026-41048
Incorrect caching of authentication between different polkit methods in qSnapper before version 1.3.3 allowed a local at
Incorrect caching of authentication between different users of the qSnapper dbus service before...
CVE-2026-41049
Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3 allowed a
A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a...
CVE-2026-41045
A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a local attacker to bypass
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8...
CVE-2026-12628
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0
A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3...
CVE-2026-41046
A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed a local attacker to
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass...
CVE-2026-10845
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorize
Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers
CVE-2026-25119
## Summary When `ENABLE_REVERSE_PROXY_AUTHENTICATION` is enabled, Gogs accepts the configured authentication header (de
OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature
CVE-2026-21887
### Summary The OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axi
A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform...
CVE-2026-8918
A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/
A vulnerability has been found in Edimax BR-6478AC V2 1.23. The impacted element is the function...
CVE-2026-12806
A vulnerability has been found in Edimax BR-6478AC V2 1.23. The impacted element is the function formWlSiteSurvey of the