Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
CVE-2026-44174
### TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated
#severity:high
共收录 5513 条相关情报。
← 返回所有主题FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
CVE-2026-43947
### Summary An unauthenticated Remote Code Execution vulnerability exists in FUXA when `secureEnabled` is set to `true`
FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
CVE-2026-43946
### Summary An authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when t
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
CVE-2026-43945
**Pre-auth** RCE in FUXA via Logic Bypass Summary A Critical vulnerability chain exists in FUXA (v.1.3.0-2706) that al
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
CVE-2026-42462
### Summary An attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify
yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation
CVE-2026-42089
### Impact `yeoman-environment` versions `>= 2.9.0` and `< 6.0.1` install missing local generator packages from caller-
An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an...
CVE-2026-8676
An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bo
Missing Authorization vulnerability in AA-Team Woocommerce Envato Affiliates allows Accessing...
CVE-2025-14361
Missing Authorization vulnerability in AA-Team Woocommerce Envato Affiliates allows Accessing Functionality Not Properly
code100x contains an authentication bypass vulnerability in the Mobile API that allows...
CVE-2026-8890
code100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to impe
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an attacker with...
CVE-2026-4051
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an attacker with administrative privileges to e
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 is vulnerable to an XML external...
CVE-2026-3603
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 is vulnerable to an XML external entity injection (XXE) att
XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests
CVE-2026-48048
### Impact XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient and with slightly modified parameter
IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in...
CVE-2026-8855
IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mut
A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory...
CVE-2026-7454
A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A mal
IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM...
CVE-2026-8620
IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server
IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM...
CVE-2026-9170
IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server
IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. A privileged user,...
CVE-2026-8834
IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. A privileged user, authenticated to the Administr
IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module...
CVE-2026-8854
IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache.
Arcane: Missing admin authorization on global variables endpoint
CVE-2026-47125
Arcane 后端项目中，`PUT /api/environments/{id}/templates/variables` 端点用于写入全局 `.env.global` 文件，该文件中的变量会被所有项目的 Docker Compose 文件
Parse Server: Pre-authentication denial of service via client version header regex backtracking
CVE-2026-47138
### Impact An unauthenticated attacker who knows a publicly-known Parse Application ID can submit a single HTTP request