Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service...
CVE-2026-101088
Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentinel worker (service/s
#severity:medium
共收录 5477 条相关情报。
← 返回所有主题Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1...
CVE-2026-101063
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authen
A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to...
CVE-2026-100875
A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be
A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to...
CVE-2026-100874
A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This af
Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state...
CVE-2026-101056
Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID.
Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node...
CVE-2026-101048
Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/
Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application...
CVE-2026-101047
Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enter
The account recovery (password reset) functionality in the vulnerability-lookup web application...
CVE-2026-101041
The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces...
CVE-2026-100868
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in si
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in...
CVE-2026-101033
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operati
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest...
CVE-2026-100867
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before renderi
onefetch through 2.28.1 writes repository information field values to the terminal without...
CVE-2026-100866
onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters,
Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due...
CVE-2026-100747
Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF toke
Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0
CVE-2026-100748
Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0
Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6...
CVE-2026-97165
Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” par
Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6...
CVE-2026-100749
Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned fi
A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its...
CVE-2026-93304
A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has
wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where...
CVE-2026-89133
wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly e
A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress)...
CVE-2026-89134
A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN
A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared...
CVE-2026-89135
A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certifi