Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
CVE-2026-87012
# Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value ## Summary Calendar
#severity:medium
共收录 5476 条相关情报。
← 返回所有主题Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
CVE-2026-87013
## Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. T
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
CVE-2026-87014
## Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every us
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper...
CVE-2026-9176
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls
Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
CVE-2026-87015
## Summary When more than one external tool server is reachable in the same request, a tool call to a server configured
n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
CVE-2026-86073
## Impact The OAuth token endpoint bound an authorization code's first access token to the consented resource, but not
n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content
CVE-2026-86074
## Impact Instance AI credential setup accepted a credential test/verification URL without checking it matched the work
n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
CVE-2026-86995
## Impact The Git node validated the repository that a fetch or pull targeted, but `setUpstream` wrote a `branch..remot
n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
CVE-2026-86085
## Impact The endpoints `/rest/roles/:slug/assignments` and `/rest/roles/:slug/assignments/:projectId/members` checked
n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
CVE-2026-86993
## Impact A log streaming event destination may reference a generic HTTP credential, and the destination resolved and d
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-87048
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-87046
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-87073
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-87033
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-87037
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an information disclosure vulnerability in Comply.
CVE-2026-87035
Tanium addressed an information disclosure vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-87047
Tanium addressed an improper access controls vulnerability in Comply.
The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in...
CVE-2026-12956
The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and inclu
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-87025
Tanium addressed an improper access controls vulnerability in Comply.
The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross...
CVE-2026-13709
The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq