| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-126182 | 7.2 | A improper control of generation of code ('code injection') vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 t | 2026-11-13 14:17:53 | 2026-11-11 22:17:17 |
| CVE-2026-125374 | 4.3 | Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags | 2026-11-13 14:17:53 | 2026-11-10 00:17:09 |
| CVE-2026-125370 | 9.8 | Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with | 2026-11-13 14:17:53 | 2026-11-10 00:17:09 |
| CVE-2026-125366 | 5.4 | Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /add_feed. Attackers can supply internal addresses that getFeedInfo, gofeed | 2026-11-13 14:17:53 | 2026-11-10 00:17:08 |
| CVE-2026-125362 | 3.1 | Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can reques | 2026-11-13 14:17:52 | 2026-11-10 00:17:07 |
| CVE-2026-125358 | 8.1 | Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any | 2026-11-13 14:17:52 | 2026-11-10 00:17:07 |
| CVE-2026-125120 | 9.8 | Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An appli | 2026-11-13 14:17:52 | 2026-11-09 23:17:22 |
| CVE-2026-125116 | 4.8 | Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default __t field, to index plain-obje | 2026-11-13 14:17:52 | 2026-11-09 23:17:21 |
| CVE-2026-125112 | - | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bi | 2026-11-13 14:17:52 | 2026-11-09 22:18:42 |
| CVE-2026-125214 | 7.0 | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcm_bluray_decode_frame() in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sa | 2026-11-13 14:17:52 | 2026-11-09 19:16:58 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/40249
Zapisa po stranici: