Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking:...
CVE-2026-108758
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauth
#severity:high
共收录 5417 条相关情报。
← 返回所有主题LlamaFarm through 0.0.34 contains an insecure default configuration that binds its...
CVE-2026-108760
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because...
CVE-2026-108708
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every ca
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated...
CVE-2026-108694
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server fil
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability...
CVE-2026-108695
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accoun
ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path...
CVE-2026-108693
ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscrip
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows...
CVE-2026-108700
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list
1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in...
CVE-2026-108692
1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldControll
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any...
CVE-2026-108671
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP se
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api...
CVE-2026-108677
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-pri
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api...
CVE-2026-108648
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endp
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any...
CVE-2026-108661
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer te
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController...
CVE-2026-108657
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the...
CVE-2026-108628
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepa
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController...
CVE-2026-108623
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that
Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
CVE-2026-66566
Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an...
CVE-2026-22061
Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker
OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP...
CVE-2026-75351
OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path pa
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
## Summary Vikunja ships with `cors.origins` defaulting to `http://127.0.0.1:*` and `http://localhost:*`, and sends `Ac
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
CVE-2026-107805
## Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controll