A vulnerability was determined in JeecgBoot up to 3.9.1. The affected element is the function...
CVE-2026-9580
A vulnerability was determined in JeecgBoot up to 3.9.1. The affected element is the function LoginController.selectDepa
#severity:medium
共收录 5624 条相关情报。
← 返回所有主题A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0. This...
CVE-2026-9575
A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0. This issue affects some unknown
A flaw has been found in itsourcecode Student Transcript Processing System 1.0. This...
CVE-2026-9574
A flaw has been found in itsourcecode Student Transcript Processing System 1.0. This vulnerability affects unknown code
A vulnerability was detected in itsourcecode Student Transcript Processing System 1.0. This...
CVE-2026-9573
A vulnerability was detected in itsourcecode Student Transcript Processing System 1.0. This affects an unknown part of t
Missing Authorization vulnerability in Magepeople inc. WpTravelly allows Exploiting Incorrectly...
CVE-2026-27331
Missing Authorization vulnerability in Magepeople inc. WpTravelly allows Exploiting Incorrectly Configured Access Contro
Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly...
CVE-2026-25444
Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Contr
Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce...
CVE-2026-25426
Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Exploiting Incorrectl
Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly...
CVE-2026-24520
Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Secu
XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin
CVE-2026-48047
### Impact A potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension in
CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS
CVE-2026-26028
### Summary CryptPad’s HTML sanitizer in Diffmarked.js can be bypassed due to incomplete filtering of restricted tags. B
A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack...
CVE-2026-7453
A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leadin
Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers
CVE-2026-39964
### Summary The Typebot viewer (`packages/embeds/js`) renders anchor tags from rich text bubble content without filteri
Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members
CVE-2026-47124
Nezha Monitoring 是一个开源监控系统，其仪表板 WebSocket 端点存在授权绕过漏洞（CVE-2026-47124）。任何经过认证的非管理员成员都可以连接到 `/api/v1/ws/server` WebSocket 并
instagrapi: Unsafe signup challenge path handling in instagrapi
instagrapi 是一个用于与 Instagram API 交互的 Python 库，其版本 2.6.9 之前存在不安全的路径处理漏洞。在 signup（注册）挑战流程中，服务器返回的 challenge 路径被直接用于构建后续请求 U
aiograpi: Unsafe signup challenge path handling
CVE-2026-47157
aiograpi 是一个用于与 Instagram API 交互的 Python 库，支持注册、登录等操作。在版本 0.9.10 之前，该库在处理注册挑战（signup challenge）时存在路径处理漏洞。攻击者可以通过篡改服务器返回的
Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)
CVE-2026-47120
## Summary `createAlertRule` and `createService` (and their `update*` siblings) accept `FailTriggerTasks []uint64` and
Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance
CVE-2026-46715
### Summary Flask-Security-Too 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an O
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
CVE-2026-8723
### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on a
ImageMagick: Heap Buffer Over-Read in distributed pixel cache server
CVE-2026-47166
An attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in the server proces
ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model
CVE-2026-47165
The distributed pixel cache was originally designed to operate without a challenge–response authentication model. Howeve