All CVEs — page 362 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
This flaw allows attackers to read local files or make internal network requests via XML external entity declarations, posing a significant security risk due to the improper restriction of XML external entity references.
This vulnerability allows authenticated users to bypass authorization checks and access restricted MCP servers, due to a missing route in the deny list.
The flaw allows authenticated users to exploit a server-side request forgery vulnerability to fetch internal URLs, potentially leading to credential exposure.
The flaw allows an authenticated user to inject unescaped content into a script, potentially compromising an admin session.
Ghost versions 6.20.0 before 6.57.1 allow authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication, due to improper session management.