Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to...
CVE-2021-47963
Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to execute arbitrary code by in
#severity:medium
共收录 5624 条相关情报。
← 返回所有主题CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated...
CVE-2021-47958
CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrar
phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes...
CVE-2026-45009
phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated
Podcast Generator 3.1 contains a persistent cross-site scripting vulnerability that allows...
CVE-2021-47968
Podcast Generator 3.1 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to in
phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api...
CVE-2026-46365
phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/{tagId} endpo
AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`
CVE-2026-45619
CVE-2026-43884 fix `603e7bf` patched `EpgParser.php` and `plugin/AI/receiveAsync.json.php` to use `url_get_contents` (re
AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA
CVE-2026-45610
## Summary **Type:** Cross-site request forgery on the 2FA toggle. `plugin/LoginControl/set.json.php` accepts `POST typ
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
CVE-2026-45580
## Summary **Type:** Stored cross-site scripting. The Live plugin's "YouTube-style" view renders the live transmission'
Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site...
CVE-2026-23695
Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in t
Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`
CVE-2026-46383
### Summary Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe us
arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS
### Summary Three medium-severity issues in arnika affecting the UDP key-rotation protocol, PQC key file handling, and K
rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution
`InlineVec::clear()` and `SerVec::clear()` in `rkyv` were not panic-safe. Both functions iterate over their elements and
Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE
### Am I affected? Users are affected if all of the following are true: - The application uses `better-auth` at a vers
Weblate: Stored HTML injection in editor search preview
CVE-2026-45106
### Impact Weblate's live search preview renders unit `source` and `context` as HTML without escaping. Any contributor w
SimpleSAMLphp casserver: Open Redirect in logout
CVE-2025-65954
### Summary The logout endpoint accepts a `url` query parameter to redirect to. casserver treats that url as trusted,
Medical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to Insecure...
CVE-2025-67437
Medical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to Insecure Permissions, which allows a
Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing...
CVE-2026-39053
Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic. When attacker-co
* Countermeasures for DPA within SYMCRYPTO engine on SixG301xxx devices are not sufficiently...
CVE-2025-14972
* Countermeasures for DPA within SYMCRYPTO engine on SixG301xxx devices are not sufficiently random and will eventually
Oinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner. The method...
CVE-2026-39052
Oinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner. The method ScriptRunner.run(String express
Imager versions through 1.030 for Perl allow a heap out of bounds (OOB) write on crafted multi...
CVE-2026-8669
Imager versions through 1.030 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files. Imager: