آخرین آسیب‌پذیری‌ها

Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}

Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo

Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery

phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set

phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled

phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting

phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql

OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity

OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username

Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation

Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation

CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation

CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()

CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching

CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type

Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create

OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting

n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes

Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters

SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()

SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()

SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING