phpMyFAQ: IDOR Account Takeover
### Summary An Insecure Direct Object Reference (IDOR) vulnerability in phpMyFAQ's Admin API allows any authenticated ad
#severity:high
共收录 5513 条相关情报。
← 返回所有主题phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation
### Summary The password reset API can be triggered without authentication and without any out-of-band confirmation ste
wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None
## Summary GHSA-mhc8-p3jx-84mm (CVE-2026-43948) reported that wger's `reset_user_password` and `gym_permissions_user_ed
Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code...
CVE-2026-45584
Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.
Multiple flaws have been identified in `named` related to the handling of DNS messages whose...
CVE-2026-5946
Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`
Undefined behavior may result due to a race condition leading to a use-after-free violation. If...
CVE-2026-5947
Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incomi
MediaArea MediaInfoLib Channel Splitting heap-based buffer overflow vulnerability
CVE-2026-22554
MediaArea MediaInfoLib Channel Splitting heap-based buffer overflow vulnerability
Improper link resolution before file access ('link following') in Azure Portal Windows Admin...
CVE-2026-42834
Improper link resolution before file access ('link following') in Azure Portal Windows Admin Center allows an authorized
Improper link resolution before file access ('link following') in Microsoft Defender allows an...
CVE-2026-41091
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to el
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...
CVE-2026-42383
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooComme
A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue...
CVE-2026-3593
A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.
Plug: Unbounded buffer accumulation in multipart header parsing causes denial of service
CVE-2026-8468
### Summary An Allocation of Resources Without Limits or Throttling vulnerability in `Plug.Conn.read_part_headers/2` al
Diffusers: TOCTOU Trust Remote Code Bypass
CVE-2026-45804
## Background This vulnerability is found in the `diffusers` package - the `transformers`-equivalent library for diffus
The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url'...
CVE-2026-9010
The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameter
E-LAN Hybrid Recording System developed by TONNET has a SQL Injection vulnerability, allowing...
CVE-2026-9003
E-LAN Hybrid Recording System developed by TONNET has a SQL Injection vulnerability, allowing unauthenticated remote att
A broken access control issue has been identified in the Talend Administration Center, that...
CVE-2026-9057
A broken access control issue has been identified in the Talend Administration Center, that allows a user with “View” pe
The Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File...
CVE-2026-7522
The Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File Inclusion in versions up to, an
mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator...
CVE-2026-7460
mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager. The Queue Ma
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker...
CVE-2026-24214
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integer ove
NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could ...
CVE-2026-24163
NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deseri