Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization security settings can enable mandatory two-factor authenticati...

CVE-2026-56212

Capgo 在 12.128.2 之前版本中存在身份验证逻辑缺陷：拥有管理团队或组织安全设置权限的用户可以强制所有团队成员启用双因素身份验证，而无需先在自己的账户上启用双因素身份验证。应用程序在进行策略更改前未能验证发起者的双因素身份验证状

历史摘要 · 未重新核验 · NVD

Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.record_build_time, which is granted ...

CVE-2026-56082

Capgo（项目 Cap-go/capgo）12.128.2 之前版本中存在不当访问控制漏洞。漏洞位于 PostgREST RPC 函数 public.record_build_time 中，该函数被定义为 SECURITY DEFINER

历史摘要 · 未重新核验 · NVD

Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin enables the policy and successfully changes their password to a compliant one, ...

CVE-2026-56080

Capgo 12.128.2 之前版本中的“强制密码策略”功能存在缺陷。当超级管理员启用该策略并成功将密码更改为合规密码后，后端未能更新帐户的密码合规状态。因此，后端仍将帐户视为不合规，并不断强制要求更改密码，导致即使使用有效凭据进行身份验

历史摘要 · 未重新核验 · NVD

Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other tenants' webhook sec...

CVE-2026-56079

CVE-2026-56079 是 Capgo 平台（版本低于 12.128.2）中存在的一个跨租户授权绕过漏洞。该漏洞位于 PostgREST 端点，允许拥有组织作用域读取权限的 API 密钥访问其他租户的 webhook 密钥和投递日志。

历史摘要 · 未重新核验 · NVD

Structured lattices and their applications to security

本文是一篇关于结构化格（structured lattices）的综述，重点讨论其在安全领域的应用，特别是格密码学和安全无线通信。文章首先介绍了欧几里得格的基本概念及其丰富的数学结构，例如由数域扩张产生的格，以及一类特殊的“良好圆整格”（w

历史摘要 · 未重新核验 · arXiv cs.CR

Kestra is an open-source, event-driven orchestration platform. Prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, Kestra task `inputFiles` writes rendered file names directly...

CVE-2026-48129

Kestra is an open-source, event-driven orchestration platform. Prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, Kes

历史摘要 · 未重新核验 · NVD

Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-47645

Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized atta

历史摘要 · 未重新核验 · NVD

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4....

CVE-2026-47203

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-o

历史摘要 · 未重新核验 · NVD

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

CVE-2026-42895

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unaut

历史摘要 · 未重新核验 · NVD

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerability exists...

CVE-2026-49345

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19,

历史摘要 · 未重新核验 · NVD

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine (`/admin/queries/execute`) accept...

CVE-2026-49344

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19,

历史摘要 · 未重新核验 · NVD

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 3.0.0 through 3.0.8, ProxySQL's GenAI/MCP `run_sql_readonly` tool violates its documented read-on...

CVE-2026-48774

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 3.0.0 through 3.0.8, ProxySQL's GenAI/MC

历史摘要 · 未重新核验 · NVD

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user ...

CVE-2026-48089

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instanc

历史摘要 · 未重新核验 · NVD

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three indepe...

CVE-2026-9375

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when u

历史摘要 · 未重新核验 · NVD

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in `ServeCreateOrUpdatePlaylist` allows any authenti...

CVE-2026-49340

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic e

历史摘要 · 未重新核验 · NVD

gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added an ownersh...

CVE-2026-49339

gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6

历史摘要 · 未重新核验 · NVD

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/...

CVE-2026-49338

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subso

历史摘要 · 未重新核验 · NVD

@microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-preview.97 through 1.0.0-preview.101, `@microsoft/kiota-http-...

CVE-2026-49336

@microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-prev

历史摘要 · 未重新核验 · NVD

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.0 parse hexadecimal / octal / binary integer literals via a h...

CVE-2026-49293

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.0 pa

历史摘要 · 未重新核验 · NVD

mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all re...

CVE-2026-49291

mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpo

历史摘要 · 未重新核验 · NVD