MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. Prior to 0.1.1, the use of eval() to evaluate mathematical expressions withou...

CVE-2026-44717

MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. Prior to 0.1.1, the

历史摘要 · 未重新核验 · NVD

OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria() method in OpenMRS ...

CVE-2026-41258

OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptRe

历史摘要 · 未重新核验 · NVD

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate web...

CVE-2026-8398

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421

历史摘要 · 未重新核验 · NVD

The Form Notify plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.1.10. This is due to the plugin trusting user-controlled cookie dat...

CVE-2026-5229

The Form Notify plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.1.10. This

历史摘要 · 未重新核验 · NVD

PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting (XSS) vulnerability in the PrestaShop back-office Custo...

CVE-2026-44212

PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scriptin

历史摘要 · 未重新核验 · NVD

Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secr...

CVE-2026-8634

Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a

历史摘要 · 未重新核验 · NVD

Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the NixOS module default), anyone who can reach /proto can reg...

CVE-2026-44592

Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the N

历史摘要 · 未重新核验 · NVD

Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any...

CVE-2026-44523

Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JW

历史摘要 · 未重新核验 · NVD

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior...

CVE-2026-44542

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-contr

历史摘要 · 未重新核验 · NVD

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new a...

CVE-2026-20182

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fi

历史摘要 · 未重新核验 · NVD

关于Microsoft ExchangeServer存在多个...

关于Microsoft ExchangeServer存在多个...

历史摘要 · 未重新核验 · CNCERT

Crypt::DSA versions before 1.20 for Perl generate seeds using rand. Seeds were generated using Perl's built-in rand function, which is predictable and unsuitable for security u...

CVE-2026-8700

CVE-2026-8700 影响 Perl 的 Crypt::DSA 模块，版本低于 1.20。该模块在生成 DSA 签名所需的随机种子时，使用了 Perl 内置的 rand 函数。Perl 的 rand 函数基于线性同余生成器，不是密码学

历史摘要 · 未重新核验 · NVD

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the API /api/v1/notes/{note_id} endpoint lacks proper authori...

CVE-2026-45666

Open WebUI 是一个自托管的离线人工智能平台。在 0.8.11 之前版本中，API /api/v1/notes/{note_id} 端点缺少适当的授权检查，允许已通过身份验证的用户通过猜测或枚举 UUID 来检索其他用户的笔记。这导

历史摘要 · 未重新核验 · NVD

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, an internal-only bypass_filter parameter is exposed on the /o...

CVE-2026-45365

Open WebUI 是一个自托管的离线人工智能平台。在版本 0.8.11 之前，存在一个安全漏洞：内部仅使用的 bypass_filter 参数通过 FastAPI 查询字符串绑定暴露在 /openai/chat/completions

历史摘要 · 未重新核验 · NVD

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.9, when a regular user [non-admin] logs into the application, a h...

CVE-2026-45351

Open WebUI 是一款自托管的人工智能平台，旨在完全离线运行。在版本 0.8.9 之前，存在一个信息泄露漏洞（CVE-2026-45351）。当普通用户（非管理员）登录应用程序后，应用会自动发起一个到 /api/models 的 HT

历史摘要 · 未重新核验 · NVD

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.6, there is a vulnerability in chat completion API, which allows ...

CVE-2026-45350

Open WebUI 是一个自托管的离线人工智能平台。在 0.8.6 版本之前，其聊天补全 API 存在一个权限检查缺失漏洞。具体来说，API 端点允许用户提供 tool_ids 和 tool_servers 参数，这些参数被中间件用于构建

历史摘要 · 未重新核验 · NVD

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.5.7, a user can modify another user's model even if its visibility ...

CVE-2026-45345

该漏洞存在于Open WebUI（一个自托管的人工智能平台，支持完全离线运行）中，影响版本0.5.7之前。由于权限检查缺失，低权限用户能够修改其他用户的私有模型：即使模型的可见性设置为“私有”，攻击者在编辑模型时可以通过更改访问权限来获得未

历史摘要 · 未重新核验 · NVD

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, his advisory tracks a regression of the original Excel-preview...

CVE-2026-45318

CVE-2026-45318 是一个存在于 Open WebUI（一个自托管的离线 AI 平台）中的跨站脚本（XSS）漏洞的回归。该漏洞源于先前已修复的 Excel 预览 XSS 漏洞（CVE-2026-44549）在 v0.8.0 之后的

历史摘要 · 未重新核验 · NVD

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, an application-wide Cross-Site Request Forgery (CSRF) vulnerab...

CVE-2026-45317

Open WebUI 是一个自托管的人工智能平台，设计为完全离线运行。在 0.9.3 版本之前，其图像上传功能存在一个应用程序范围内的跨站请求伪造（CSRF）漏洞。攻击者可以通过设置一个指向恶意端点的图像 URL，诱使受害者查看该图像（例如

历史摘要 · 未重新核验 · NVD

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the POST /api/v1/notes/{id}/pin endpoint performs a write oper...

CVE-2026-45316

Open WebUI 是一个自托管的人工智能平台，旨在完全离线运行。在 0.9.3 版本之前，其 POST /api/v1/notes/{id}/pin 端点存在权限校验缺陷：该端点用于切换笔记的 is_pinned 状态（执行写操作），但

历史摘要 · 未重新核验 · NVD