Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs
### Summary Two endpoints serving in-house iOS application packages and manifests in Fleet's enterprise tier are reacha
#severity:medium
共收录 5482 条相关情报。
← 返回所有主题Winter: Local File Inclusion through =include directives in JavaScript asset compilation
### Impact Affected versions of Winter CMS allow authenticated backend users with the `cms.manage_assets` permission ("
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
CVE-2026-63179
### Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
CVE-2026-61799
## Summary `io.netty.incubator:netty-incubator-codec-bhttp` uses attacker-controlled Binary HTTP variable-length intege
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
CVE-2026-61663
## Summary The django-cms frontend-editing structure endpoint ``` GET //admin/cms/placeholder/object//structure// ```
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
CVE-2026-63003
## Impact The only authorization gate on the duplicate flow is `PageAdmin.has_add_permission`, which checks `user_can_a
django CMS: Stored XSS in edit-mode plugin exception rendering
CVE-2026-75526
## Summary When plugin rendering fails in edit mode, django CMS renders a `cms-rendering-exception` block so editors ca
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
CVE-2026-57570
## Vulnerability Details Affected area: HasMany / MorphMany relation handling during CRUD create and update operations
Wagtail: Improper restriction handling on Pages admin API
CVE-2026-55468
### Impact The internal Pages admin [API](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorrectl
django CMS: Structure endpoint bypasses page-view permission
CVE-2026-54624
### Summary The structure-board endpoint (`render_object_structure`) renders a page's plugin structure without verifying
Bluetooth AVRCP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows...
CVE-2026-76917
Bluetooth AVRCP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
3gpp phone log file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CVE-2026-76920
3gpp phone log file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
H.245 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CVE-2026-76927
H.245 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
A flaw has been found in mruby 3.1.0. Affected is the function udiv of the file bigint.c....
CVE-2022-4996
A flaw has been found in mruby 3.1.0. Affected is the function udiv of the file bigint.c. Executing a manipulation can l
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CVE-2026-76921
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CVE-2026-76919
ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
SSH protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CVE-2026-76918
SSH protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Kerberos protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CVE-2026-76924
Kerberos protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
UMTS FP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CVE-2026-76889
UMTS FP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial...
CVE-2026-76922
Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service