3274 matches found
CVE-2026-100278
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments...
CVE-2026-95360
Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...
DEBIAN-CVE-2026-95360
Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-95360
Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-2586
经过身份验证的GlassFish EL注入RCE（CVE-2026-2586） GlassFish管理控制台中存在一个表达式语言注入漏洞，允许经过身份验证的用户将恶意的EL表达式注入到管理Web界面处理的参数中。成功利用该漏洞可能导致在受影响服务器上远程执行命令。 该漏洞在服务器虚拟配置编辑流程中被发现，在此流程中，用户可控的参数被应用程序不安全地解释。 原因如下： 管理界面在处理EL表达式时使用了用户可控的参数。 输入在后端解释之前未经过适当的验证或清理。 管理控制台中经过身份验证的用户可以滥用此漏洞行为来调用Java类和方法。...
FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95360): chromium -- security fixes
Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-101018
A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function groupalledit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carrie...
CVE-2026-101018 dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection
A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function groupalledit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carrie...
CVE-2026-101018 dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection
A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function groupalledit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carrie...
EUVD-2026-88203
A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function groupalledit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carrie...
CVE-2026-101018
The dayrui XunruiCMS software, version up to 4.7.2 , contains a SQL injection vulnerability within the Group Editing component. The flaw exists in the group_all_edit function of the file dayrui/App/Member/Controllers/Admin/Home.php , where insufficient sanitization of the groupid argument allows ...
CVE-2026-101018: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function groupalledit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carrie...
CVE-2020-29254
CVE-2020-29254 TikiWiki 21.2 允许在未使用 CSRF 防护的情况下编辑模板。 ========================== 跨站请求伪造 CSRF： TikiWiki 21.2 允许在未使用 CSRF 防护的情况下编辑模板。这可能导致未经验证的远程攻击者实施跨站请求伪造 CSRF 攻击，并在受影响系统上执行任意操作。该漏洞源于受影响系统的基于 Web 的管理界面缺乏足够的 CSRF 防护。攻击者可利用此漏洞诱使用户访问恶意构造的...
CVE-2026-93643
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...
EUVD-2026-87101
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...
FeatMark: Feature-Level Watermark Protection against Mimicry Attacks with Diffusion Models
Text-to-image diffusion models enable data-efficient "mimicry" attacks, wherein adversaries fine-tune the model on a handful of public photos to synthesize convincing forgeries of a target individual. A common countermeasure is to embed imperceptible, low-energy watermarks, yet recent studies sho...
CVE-2026-93643: Improper Limitation of a Pathname to a Restricted Directory
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...
Linux Distros Unpatched Vulnerability : CVE-2026-95360
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a...
PT-2026-97516
Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description Broken Access Control ACL Bypass exists in the ApiController record editing functionality. The allowEdit function in ApiController.php contains a hardcoded return value of true, which bypasse...
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently restrict access to raw webform source editing when the Webform UI module is not enabled. This could allow a user with webform creation ...