Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
CVE-2026-94462
## Summary The Store API v3 endpoint `PATCH /api/v3/store/carts/:id/associate` binds a guest cart to the authenticated
#severity:high
共收录 5373 条相关情报。
← 返回所有主题lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
CVE-2026-85740
## Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack d
Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability
CVE-2026-76819
A vulnerability in the Goja JavaScript engine used by Nuclei's `javascript:` protocol allows arbitrary native code execu
Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for
CVE-2026-77560
# tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an aut
KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API
CVE-2026-62371
## Impact The KubeEdge NodeUpgradeJob handler constructed the `keadm upgrade edge` command by concatenating the user-co
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join
CVE-2026-62369
## Description KubeEdge `keadm` contains a path traversal vulnerability in the `DecompressTarGz` archive extraction fun
A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects...
CVE-2026-94128
A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects the function sub_1105C of
A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. This vulnerability...
CVE-2026-94129
A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. This vulnerability affects the function sub_1105
A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected...
CVE-2026-94101
A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function v
A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. Impacted is the function...
CVE-2026-94100
A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. Impacted is the function wan_config_set_vlan of th
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects...
CVE-2026-94098
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the fil
A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects...
CVE-2026-94099
A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of
A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some...
CVE-2026-94096
A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of
A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this...
CVE-2026-94095
A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown funct
A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402....
CVE-2026-94036
A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element i
Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla...
CVE-2026-88855
Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Jooml
Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure...
CVE-2026-94113
Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in white
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing...
CVE-2026-94112
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured
openEQUELLA versions before 2026.1.0 contain a remote code execution vulnerability in FreeMarker...
CVE-2026-94109
openEQUELLA versions before 2026.1.0 contain a remote code execution vulnerability in FreeMarker template compilation du
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi(...
CVE-2026-94104
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails t