A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is...
CVE-2026-10154
A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is an unknown function of
#severity:medium
共收录 5624 条相关情报。
← 返回所有主题Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to crash the...
CVE-2018-25423
Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplyin
A vulnerability was detected in code-projects Student Details Management System 1.0. This affects...
CVE-2026-10110
A vulnerability was detected in code-projects Student Details Management System 1.0. This affects an unknown function of
A flaw has been found in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0. This impacts an unknown...
CVE-2026-10111
A flaw has been found in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0. This impacts an unknown function of the component Logi
Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading...
CVE-2026-48840
Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of unini
A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could...
CVE-2026-9831
A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-c
praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership
CVE-2026-47408
## Summary **Type:** Insecure Direct Object Reference. The `GET /workspaces/{workspace_id}/issues/{issue_id}/activity`
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
CVE-2026-47395
### Summary PraisonAI's direct-prompt CLI automatically expands `@url:` mentions in raw prompt text before agent execut
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
CVE-2026-47390
### Summary PraisonAI's `spider_tools` URL validation can be bypassed using alternate loopback host encodings. The aff
Nezha's authenticated DDNS webhook configuration allows blind SSRF from the dashboard host
CVE-2026-47268
#### Summary An authenticated Nezha dashboard user can create or update a DDNS profile with provider `webhook` and conf
Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
CVE-2026-47233
## Summary Commit `d37ca6b27b9674238e58491cf7ba292e66898f15` ("Delete item not check admin rights #2024", 2026-04-12) a
Admidio writes session IDs and auto-login cookie values to application logs
CVE-2026-47234
## Summary When debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs th
Admidio PKCS#12 private key export action lacks CSRF protection
CVE-2026-47232
## Summary The sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bundle containing the configu
Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders
CVE-2026-47230
## Summary `modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the cross-folder m
Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation
CVE-2026-47229
## Summary `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing branch except `enable`. The
Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords
CVE-2026-47228
## Summary `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores
Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`
CVE-2026-47227
## Summary `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) correspon
Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges
CVE-2026-47226
### Summary An authenticated Admidio member with upload rights on **any one folder** can permanently delete files from
BoxLite has a Timeout Bypass Vulnerability
CVE-2026-47213
#### Summary BoxLite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI
Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification
CVE-2026-47212
### Description The Twilio SMS notifier bridge ships a webhook request parser used to authenticate and decode the statu