NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
CVE-2026-52888
# Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass ## Summary The `checkSQL()` function
#severity:medium
共收录 5514 条相关情报。
← 返回所有主题Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel
CVE-2026-49446
### Summary The Constellation-tunnel bypass branch in `tokenMiddleware` at `src/proxy/routerGen.go:53-66` returns to th
Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens
CVE-2026-49447
### Summary `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that s
Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks
CVE-2026-50569
`HTTPTriggerSpec.Validate()` validated `Methods`, `FunctionReference`, `Host`, `IngressConfig`, and `CorsConfig`, but si
Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.
CVE-2026-65445
Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – AcyChecker <= 1...
CVE-2026-65448
Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – AcyChecker <= 1.8.1 versions.
The vulnerability involves an Insecure Direct Object Reference (IDOR) in the ...
CVE-2026-59240
The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` me
Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component....
CVE-2026-66825
Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with li
org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages
CVE-2023-37465
### Impact It's possible to forge a request to delete a message. ### Patches The problem has been patched in version 2
A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function...
CVE-2026-17501
A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file commo
A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function...
CVE-2026-17500
A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function _visit_pattern of the file
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to...
CVE-2026-57978
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a ne
ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line...
CVE-2026-66011
ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid optio
A flaw was found in libsoup. An unsigned integer underflow in the...
CVE-2026-66337
A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup...
CVE-2026-66339
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches t
A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing...
CVE-2026-66338
A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes tha
The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system...
CVE-2026-55985
The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext o
FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
## Summary The OpenAPI adapter's spec-change **poller** (`OpenApiSpecPoller`) re-fetched the configured spec `url` on a
kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema
| Field | Value | |---|---| | Ecosystem | Go | | Package | `github.com/getkin/kin-openapi` | | Affected versions | `<= 0
Quasar: Prototype pollution in the extend() utility
### Summary `quasar@2.20.1`, the latest published version at the time of testing, appears to be vulnerable to prototype