OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker...
CVE-2026-92792
OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing
#severity:high
共收录 5373 条相关情报。
← 返回所有主题Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but...
CVE-2026-92789
Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions,...
CVE-2026-92793
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated use
LightGBM through 4.7.0 fails to validate child and split array values when parsing text models,...
CVE-2026-92786
LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to wr
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes...
CVE-2026-92788
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's
Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint,...
CVE-2026-92791
Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated att
KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints,...
CVE-2026-92780
KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image...
CVE-2026-92775
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches
Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint...
CVE-2026-92783
Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with r
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules,...
CVE-2026-92776
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to a
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections,...
CVE-2026-92782
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated a
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution...
CVE-2026-92779
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set hel
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App...
CVE-2026-92773
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it
Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources...
CVE-2026-92763
Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project arch
ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint...
CVE-2026-92765
ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticate
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records...
CVE-2026-92771
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing
Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install...
CVE-2026-92772
Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks perm
Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through...
CVE-2026-92762
Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner...
CVE-2026-92770
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credenti
WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view...
CVE-2026-92761
WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform pri