picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing...
CVE-2026-56304
picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to cr
#severity:medium
共收录 5559 条相关情报。
← 返回所有主题Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and...
CVE-2026-56330
Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and stripe_checkout endpoints that accept
Capgo before 12.128.2 contains an authorization bypass vulnerability in webhook management...
CVE-2026-56295
Capgo before 12.128.2 contains an authorization bypass vulnerability in webhook management endpoints that allows non-exp
Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that...
CVE-2026-56332
Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to re
Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated ...
CVE-2026-56282
Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint that
capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where...
CVE-2026-56294
capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSuc
Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient...
CVE-2025-71331
Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat
Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in...
CVE-2026-56228
Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy confi
Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC...
CVE-2026-56235
Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metri
Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded...
CVE-2026-56218
Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing informa
Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL...
CVE-2026-56227
Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopbac
Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account...
CVE-2026-56267
Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoin
Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability...
CVE-2026-12673
Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalati
The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a...
CVE-2026-12119
The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization c
Capgo before 12.128.2 contains an authorization bypass vulnerability in the public...
CVE-2026-56213
Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER
Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage...
CVE-2026-56212
Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization secur
Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin...
CVE-2026-56080
Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin enables the policy and
SurrealDB: Denial of Service via deep operator chains
An authenticated user could crash a SurrealDB server with a single query containing a long chain of operators. Such a q
SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals
A record user could read field values hidden from them by field-level SELECT permissions by reaching the records through
SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field
A field can be hidden from a user with a field-level SELECT permission (`DEFINE FIELD code ON secret PERMISSIONS FOR sel