| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-124425 | 3.1 | Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with wri | 2026-11-08 14:18:08 | 2026-11-08 14:18:08 |
| CVE-2026-124424 | 7.1 | WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized response[lang] parameter. Attackers c | 2026-11-08 14:18:08 | 2026-11-08 14:18:07 |
| CVE-2026-124331 | 7.5 | A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch th | 2026-11-08 14:18:07 | 2026-11-08 14:18:07 |
| CVE-2026-123272 | 8.0 | Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers | 2026-11-08 14:18:07 | 2026-11-05 19:17:20 |
| CVE-2026-123271 | 8.0 | ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP s | 2026-11-08 14:18:07 | 2026-11-05 19:17:20 |
| CVE-2026-116818 | 8.2 | OpenPanel before 3.0.0 contains an unauthenticated ClickHouse SQL injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access ch | 2026-11-08 14:18:06 | 2026-10-27 00:17:16 |
| CVE-2026-115718 | 4.3 | Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call t | 2026-11-08 14:18:05 | 2026-10-26 12:17:05 |
| CVE-2026-124330 | 4.6 | A vulnerability was determined in FlowCI flow-core-x up to 1.23.49. This affects the function exist/save/read/remove of the file store/src/main/java/com/flowci/store/LocalFileManager.java of the component LocalFileManager. This manipulation of the ar | 2026-11-08 13:16:34 | 2026-11-08 13:16:33 |
| CVE-2026-124329 | 4.6 | A vulnerability was found in FlowCI flow-core-x up to 1.23.49. The impacted element is the function FileHelper.unzip of the file common/src/main/java/com/flowci/common/helper/FileHelper.java. The manipulation results in path traversal. The attack may | 2026-11-08 12:17:49 | 2026-11-08 12:17:48 |
| CVE-2026-124328 | 6.5 | A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java of the component Groovy Script E | 2026-11-08 11:16:34 | 2026-11-08 11:16:34 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39954
Zapisa po stranici: