| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-124680 | - | Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX. An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the same upstream and the | 2026-11-13 23:17:14 | 2026-11-13 18:17:31 |
| CVE-2026-124679 | - | Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decr | 2026-11-13 23:17:14 | 2026-11-13 18:17:31 |
| CVE-2026-124666 | - | Authentication bypass by spoofing vulnerability in Apache APISIX. On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that | 2026-11-13 23:17:14 | 2026-11-13 18:17:31 |
| CVE-2026-124014 | 9.1 | XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set, whi | 2026-11-13 23:17:14 | 2026-11-12 20:18:25 |
| CVE-2026-124010 | 9.8 | XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh p | 2026-11-13 23:17:14 | 2026-11-12 20:18:24 |
| CVE-2026-124006 | 8.1 | XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root | 2026-11-13 23:17:14 | 2026-11-12 20:18:23 |
| CVE-2026-121518 | 5.3 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This | 2026-11-13 23:17:13 | 2026-11-13 10:17:27 |
| CVE-2026-119077 | 9.8 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encod | 2026-11-13 23:17:13 | 2026-11-13 10:17:26 |
| CVE-2026-124002 | 9.8 | XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of l | 2026-11-13 23:17:13 | 2026-11-12 20:18:21 |
| CVE-2024-58405 | 8.6 | Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user regi | 2026-11-13 23:17:12 | 2026-11-13 10:17:23 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/40249
Zapisa po stranici: