An improper access control vulnerability exists in the Android client application for HPE...
CVE-2026-79797
An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Ma
#severity:high
共收录 5417 条相关情报。
← 返回所有主题A privilege escalation vulnerability exists in the API of AOS-S. Successful exploitation could...
CVE-2026-76748
A privilege escalation vulnerability exists in the API of AOS-S. Successful exploitation could allow an authenticated re
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding
CVE-2026-41510
## Root Cause File: `internal/corazawaf/transaction.go`, lines 770–808 (since commit 2fd87b89, PR #812, 2023-06-14) ``
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
CVE-2026-86540
## Overview A critical **Arbitrary Code Execution (ACE)** vulnerability exists in the Knowns Language Server Protocol (
Payload didn't enforce field-level password update restrictions
CVE-2026-105855
## Impact When an auth collection defined a field-level access.update restriction on the password field, the restrictio
Payload: ReDoS in Multipart Content-Type Validation
CVE-2026-105854
## Impact A malformed multipart request body could take an extremely long time to finish. ## Patches Users should upgra
Payload vulnerable to API key disclosure through ordinary document reads
CVE-2026-105849
### Impact Users with read access to other user documents could access their active API keys. An exposed key grants the
Payload Ecommerce has an order confirmation validation issue
CVE-2026-105850
## Impact When using the Stripe payment adapter, an order confirmation could be processed more than once under certain c
Payload: Token refresh and password reset responses may expose restricted user fields
CVE-2026-105853
## Impact Token refresh and password reset responses could return fields that the requesting user did not have access t
Payload: Improper access control for MCP API keys
CVE-2026-105806
### Impact Under certain conditions, an authenticated user could manage MCP API keys outside their intended account allo
Payload: Polymorphic join queries could disclose hidden fields
CVE-2026-105847
### Impact A user with query access could use polymorphic join filters to infer hidden or read-restricted field values,
Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
CVE-2026-105796
### Impact An attacker who controls or tampers with an OpenAPI description can cause Kiota to emit attacker-controlled
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
CVE-2026-104850
### Summary In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received t
openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation
CVE-2026-105801
### Impact A malicious OpenAPI document processed by any `openapi-python-client` prior to 0.29.1 can generate arbitrary
External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration
CVE-2026-26287
## Summary A bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`Enforc
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup...
CVE-2026-75962
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin
Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions.
CVE-2026-41558
Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions.
Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.
CVE-2026-105072
Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.
Unauthenticated Broken Access Control in Morning for WooCommerce <= 2.4.1 versions.
CVE-2026-39723
Unauthenticated Broken Access Control in Morning for WooCommerce <= 2.4.1 versions.
Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.
CVE-2026-39789
Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.