| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-126278 | 7.5 | NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow | 2026-11-13 23:17:15 | 2026-11-13 10:17:31 |
| CVE-2026-126270 | 6.5 | NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate | 2026-11-13 23:17:15 | 2026-11-13 10:17:29 |
| CVE-2026-126266 | 7.5 | SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with qu | 2026-11-13 23:17:15 | 2026-11-13 10:17:29 |
| CVE-2026-125055 | 9.8 | The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side f | 2026-11-13 23:17:15 | 2026-11-13 10:17:28 |
| CVE-2026-126210 | 5.3 | @hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path se | 2026-11-13 23:17:15 | 2026-11-12 22:19:18 |
| CVE-2026-126206 | - | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed_uri? treats a data URI mediatype containing the HTML5 named solidus reference / as m | 2026-11-13 23:17:15 | 2026-11-12 21:17:21 |
| CVE-2026-126190 | 7.5 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree | 2026-11-13 23:17:15 | 2026-11-12 17:17:32 |
| CVE-2026-124723 | - | Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX. With match_uri_encoded_slash enabled and skip_mtls_uri_regex configured, a client without a certificate can reach an upstream behind a route that requires | 2026-11-13 23:17:14 | 2026-11-13 18:17:31 |
| CVE-2026-124719 | - | Authentication bypass by spoofing vulnerability in Apache APISIX. When a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, a caller can act as another identity against the upstream API. This issu | 2026-11-13 23:17:14 | 2026-11-13 18:17:31 |
| CVE-2026-124716 | - | Incorrect Authorization vulnerability in Apache APISIX. An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied | 2026-11-13 23:17:14 | 2026-11-13 18:17:31 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/40249
Zapisa po stranici: