Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription...
CVE-2026-92760
Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restr
#severity:high
共收录 5373 条相关情报。
← 返回所有主题SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the...
CVE-2026-92759
SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to...
CVE-2026-92751
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that...
CVE-2026-92752
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in
PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and...
CVE-2026-92753
PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that
node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
CVE-2026-68904
SUMMARY ------- A combination of bugs in node-opcua causes unlimited TCP socket accumulation (FIN-WAIT-2 state) during a
djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session
CVE-2026-61593
### Impact The SSE client→server POST endpoints are `@csrf_exempt` and the SSE GET stream endpoint had no Origin check,
djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data
CVE-2026-61595
### Impact `djust.tenants` isolation was enforced only on the HTTP path. The current tenant was stored in `threading.loc
djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler
CVE-2026-61598
### Impact `djust.mixins.model_binding.ModelBindingMixin` provides a default `update_model` event handler and is part of
OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS
CVE-2026-81192
### Summary The `OpenTelemetry.Resources.Host` NuGet package is affected by an untrusted search path vulnerability on m
djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG
CVE-2026-61590
### Impact djust's observability endpoints expose live view/session state and a remote method-invocation surface (`eval_
Insufficient validation of inputs supplied through affected VeloCloud Edge management and...
CVE-2026-86108
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may al
The VeloCloud Edge software update workflow may accept update bundles without properly validating...
CVE-2026-86109
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures becau
On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an...
CVE-2026-73450
On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with a
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring...
CVE-2026-92299
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMe
On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated...
CVE-2026-73460
On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject
On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who...
CVE-2026-73459
On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially c
On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an...
CVE-2026-73446
On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate...
CVE-2026-85893
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to...
CVE-2026-69486
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a net