Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.224 | 0,9 % |
| ≥10 % | 22.104 | 6,0 % |
| <10 % | 345.171 | 93,0 % |
Critical BlockStrap flaw lets hackers run code on Magento servers
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...] Weiterlesen
CVE-2022-46715 | Apple iOS/iPadOS Privacy Preferences access control (EUVD-2022-49504)
A vulnerability labeled as critical has been found in Apple iOS and iPadOS. The affected element is an unknown function of the component Privacy Preferences. The manipulation results in improper access controls. This vulnerability is identi
CVE-2022-46713 | Apple macOS File System race condition (EUVD-2022-49502)
A vulnerability was found in Apple macOS. It has been classified as problematic. Impacted is an unknown function of the component File System Handler. Performing a manipulation results in race condition. This vulnerability is cataloged as C
CVE-2022-46712 | Apple macOS up to 12.7.6 App use after free (HT213488 / EUVD-2022-49501)
A vulnerability, which was classified as critical, was found in Apple macOS. This affects an unknown part of the component App Handler. The manipulation results in use after free. This vulnerability is identified as CVE-2022-46712. The atta
CVE-2022-46709 | Apple iOS 15.x Kernel memory corruption (EUVD-2022-49498)
A vulnerability was found in Apple iOS 15.x. It has been declared as critical. The affected element is an unknown function of the component Kernel. The manipulation results in memory corruption. This vulnerability is reported as CVE-2022-46
CVE-2022-46704 | Apple macOS App state issue (EUVD-2022-49493)
A vulnerability was found in Apple macOS and classified as problematic. This issue affects some unknown processing of the component App Handler. Such manipulation leads to state issue. This vulnerability is listed as CVE-2022-46704. The att
CVE-2022-46703 | Apple iOS/iPadOS Location information disclosure (EUVD-2022-49492)
A vulnerability classified as problematic has been found in Apple iOS and iPadOS. The impacted element is an unknown function of the component Location Handler. Performing a manipulation results in information disclosure. This vulnerability
Cisco Urges Customers to Patch Email Gateway Flaw and Check for Compromise
Attackers exploit a critical Cisco email gateway flaw to gain root access. Cisco urges customers to update scanner tools and check for compromise. Cisco confirmed this week that threat actors are exploiting a critical vulnerability in Cisco
CVE-2026-85831 | Microsoft Windows up to Server 2025 Windows Biometric Service buffer overflow (EUVD-2026-99540)
A vulnerability was found in Microsoft Windows up to Server 2025. It has been classified as problematic. This vulnerability affects unknown code of the component Windows Biometric Service. Performing a manipulation results in buffer overflo
CVE-2026-85830 | Microsoft Windows up to Server 2025 Installer out-of-bounds (EUVD-2026-99539)
A vulnerability was found in Microsoft Windows and classified as problematic. This affects an unknown part of the component Installer. Such manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2026-85830. An attack
CVE-2026-85833 | Microsoft Windows up to Server 2025 Modern Device Management use after free (EUVD-2026-99542)
A vulnerability was found in Microsoft Windows. It has been classified as very critical. The affected element is an unknown function of the component Modern Device Management. The manipulation leads to use after free. This vulnerability is
CVE-2026-85832 | Microsoft Windows up to Server 2025 Background Intelligent Transfer Service buffer overflow (EUVD-2026-99541)
A vulnerability has been found in Microsoft Windows and classified as very critical. This issue affects some unknown processing of the component Background Intelligent Transfer Service. Performing a manipulation results in buffer overflow.
CVE-2026-85834 | Microsoft Windows up to Server 2025 TCP IP heap-based overflow (EUVD-2026-99543)
A vulnerability categorized as very critical has been discovered in Microsoft Windows. This impacts an unknown function of the component TCP IP. Such manipulation leads to heap-based buffer overflow. This vulnerability is uniquely identifie
CVE-2026-85835 | Microsoft Windows up to Server 2025 Servicing Stack out-of-bounds (EUVD-2026-99544)
A vulnerability was found in Microsoft Windows 11 24H2/11 25H2/11 26H1/11 26H2/Server 2025. It has been rated as problematic. Impacted is an unknown function of the component Servicing Stack. The manipulation leads to out-of-bounds read. Th
CVE-2026-85836 | Microsoft Windows up to Server 2025 Kernel use after free (EUVD-2026-99545)
A vulnerability was found in Microsoft Windows 11 24H2/11 25H2/11 26H1/11 26H2/Server 2025. It has been declared as very critical. This issue affects some unknown processing of the component Kernel. Executing a manipulation can lead to use
CVE-2026-85837 | Microsoft Windows up to Server 2025 out-of-bounds (EUVD-2026-99546)
A vulnerability categorized as very critical has been discovered in Microsoft Windows 11 24H2/11 25H2/11 26H1/11 26H2/Server 2025. The affected element is an unknown function. The manipulation results in out-of-bounds read. This vulnerabili
CVE-2026-85842 | Microsoft Windows up to Server 2025 Windows Image Acquisition format string (EUVD-2026-99548)
A vulnerability was found in Microsoft Windows up to Server 2025. It has been declared as very critical. The impacted element is an unknown function of the component Windows Image Acquisition. The manipulation results in format string. This
CVE-2026-85840 | Microsoft Windows up to Server 2025 Event Viewer information disclosure (EUVD-2026-99547)
A vulnerability, which was classified as problematic, was found in Microsoft Windows. Affected by this vulnerability is an unknown functionality of the component Event Viewer. The manipulation results in information disclosure. This vulnera
CVE-2026-85843 | Microsoft Windows up to Server 2025 Background Intelligent Transfer Service uninitialized resource (EUVD-2026-99549)
A vulnerability labeled as very critical has been found in Microsoft Windows. This affects an unknown function of the component Background Intelligent Transfer Service. Such manipulation leads to uninitialized resource. This vulnerability i
CVE-2022-46702 | Apple iOS/iPadOS up to 16.1.2 GPU Drivers memory corruption (HT213530 / EUVD-2022-49491)
A vulnerability identified as problematic has been detected in Apple iOS and iPadOS up to 16.1.2. Affected is an unknown function of the component GPU Drivers. This manipulation causes memory corruption. This vulnerability is registered as
CVE-2022-46701 | Apple iOS/iPadOS up to 16.1.2 Kernel memory corruption (HT213530 / EUVD-2022-49490)
A vulnerability was found in Apple iOS and iPadOS up to 16.1.2 and classified as critical. This affects an unknown function of the component Kernel. Executing a manipulation can lead to memory corruption. The identification of this vulnerab
CVE-2026-102764 | BeyondTrust Remote Support up to 26.2.3 data authenticity (WID-SEC-2026-4001)
A vulnerability marked as very critical has been reported in BeyondTrust Remote Support up to 26.2.3. Affected by this vulnerability is an unknown functionality. The manipulation leads to insufficient verification of data authenticity. This
CVE-2026-9703 | Grafana Data Source Proxy /loki/api/v1/rules access control (WID-SEC-2026-4002)
A vulnerability was found in Grafana. It has been declared as problematic. Affected is an unknown function of the file /loki/api/v1/rules of the component Data Source Proxy. Such manipulation leads to improper access controls. This vulnerab
CVE-2026-95155 | FasterXML Jackson up to 1.9.13 ObjectMapper.readValue denial of service (WID-SEC-2026-4003)
A vulnerability classified as problematic has been found in FasterXML Jackson 1.8.3/1.9.2/1.9.11/1.9.12/1.9.13. Affected by this issue is the function ObjectMapper.readValue. This manipulation causes denial of service. This vulnerability is
Prolific Chinese espionage group exploits BeyondTrust zero-day
Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers. This article has been indexed from CyberScoop Read the or
CVE-2026-96806 | Apache Airflow Keycloak Provider up to 0.11.0 KeycloakJWTMiddleware session expiration (WID-SEC-2026-4005)
A vulnerability, which was classified as critical, was found in Apache Airflow Keycloak Provider up to 0.11.0. This issue affects some unknown processing of the component KeycloakJWTMiddleware. The manipulation results in session expiration
CVE-2026-94135 | Apache Airflow SFTP Provider up to 6.x Deferrable Code Paths no_host_key_check certificate validation (WID-SEC-2026-4005)
A vulnerability marked as problematic has been reported in Apache Airflow SFTP Provider up to 6.x. Affected is an unknown function of the component Deferrable Code Paths. This manipulation of the argument no_host_key_check causes improper c
CVE-2026-94134 | Apache Airflow SSH Provider/Airflow SFTP Provider up to 6.x SSH Hook/SFTP Hook host_key/no_host_key_check certificate validation (WID-SEC-2026-4005)
A vulnerability classified as problematic has been found in Apache Airflow SSH Provider and Airflow SFTP Provider up to 6.x. Affected by this issue is some unknown functionality of the component SSH Hook/SFTP Hook. Performing a manipulation
CVE-2026-92228 | Apache Airflow Keycloak Provider up to 0.11.0 Multi-Team Provisioning _attach_team_permissions privileges management (WID-SEC-2026-4005)
A vulnerability described as problematic has been identified in Apache Airflow Keycloak Provider up to 0.11.0. Affected by this vulnerability is the function _attach_team_permissions of the component Multi-Team Provisioning. Such manipulati
CVE-2026-91858 | Apache Camel Camel-FOP xml external entity reference (WID-SEC-2026-4006)
A vulnerability described as critical has been identified in Apache Camel. Affected is an unknown function of the component Camel-FOP. Such manipulation leads to xml external entity reference. This vulnerability is traded as CVE-2026-91858.
Warnung des BSI: Angriffe auf Zero-Day-Lücke in Cisco Secure Email Gateway - Golem.de
Der Malware-Scanner von Ciscos Secure Email Gateway reagiert fehlerhaft auf speziell gestaltete E-Mails. Hacker erhalten so Root-Rechte. Weiterlesen
CVE-2026-111678 | Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiword or corrupting style parsing.
Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages
CVE-2026-111677 | Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap allocation that crash the process.
Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF rec
CVE-2026-111676 | Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/
CVE-2026-111675 | Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-l
CVE-2026-111674 | Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names with attacker-chosen text attributed to the victim.
Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public ima
CVE-2026-111673 | IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to
CVE-2026-111672 | Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.
Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline
CVE-2026-111671 | Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to life
CVE-2026-111670 | ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables.
ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance
CVE-2026-111669 | ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques.
ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers hol
CVE-2026-111668 | AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend, and can modify suggestion statuses or generate reports.
AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes l
CVE-2026-111667 | REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve its comment content and attachment references.
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of
CVE-2026-111666 | Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names.
Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filt
CVE-2026-111665 | Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content i
Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, L
CVE-2026-111664 | Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses version checks and auto-apply settings, installing older Safing-signed releases carrying previously fixed vulnerabilities.
Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can su
CVE-2026-111663 | Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance
CVE-2026-111662 | Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService, which follows redirects and skips TLS verification, to read internal page titles and descriptions.
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private,
CVE-2026-111661 | waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject
CVE-2026-111660 | waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values,
CVE-2026-111659 | Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock.
Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId,
CVE-2026-111658 | SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.
SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission
CVE-2026-111657 | BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/mark_as_shipped endpoint to overwrite courier names and tracking numbers and mark approved returns as shipped.
BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA
CVE-2026-111656 | ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order.
ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to
CVE-2026-111655 | ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with columns like xurl, hash, or uuid to view download URLs, tamper records, or reassign ownership.
ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the
CVE-2026-111654 | FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to read, overwrite, reassign, rewrite device associations of, or delete other users' groups.
FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self
CVE-2026-111653 | 53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when IS_SAAS is true, attackers can enumerate sequential enterprise IDs and overwrite logos, display names and branding for defacement and phishing.
53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks
CVE-2026-111652 | Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin, owner, or admin checks.
Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachmen
CVE-2026-111651 | Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.
Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tena
CVE-2026-111650 | ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.
ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to act