共收录 5494 条相关情报。
← 返回所有主题CVE-2026-48786
### Summary The target search endpoint (`POST /api/latest/fleet/targets`) returned team enroll secrets and full team co
CVE-2026-47132
### Summary An authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logg
CVE-2026-45694
### Summary `LegacyController.php:75` writes the page title into a `document.title` JS assignment using string interpola
CVE-2026-32639
### Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJA
CVE-2026-32593
## Impact The Backend Filter widget (`Backend\Widgets\Filter`) is vulnerable to SQL injection through the `numberrange`
CVE-2026-9318
tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows
CVE-2026-64934
The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, witho
CVE-2026-66340
The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout
CVE-2026-66832
When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is app
CVE-2026-66148
An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.10
CVE-2026-19550
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rath
CVE-2026-73282
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operat
CVE-2026-19579
Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request
CVE-2026-70339
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized
CVE-2026-71474
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, whic
CVE-2026-66146
Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions
CVE-2026-71468
A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly
CVE-2026-73036
Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt
CVE-2026-71845
A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes
CVE-2026-71475
A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data