The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses....
CVE-2026-14898
The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could pl
2026-07-07 归档
今日共收录 976 条安全情报，包含 239 个 CVE，384 篇安全通告，以及 83 篇研究论文。
← 返回归档列表ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker...
CVE-2026-9182
ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue b
Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026...
CVE-2026-14536
Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attack
The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login...
CVE-2026-11405
The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8
Craft CMS: Sensitive File Disclosure / Server-Side File Read
CVE-2026-55792
The `dataUrl()` Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the
Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-...
CVE-2026-55615
Neo4jChatAgent passes LLM-generated Cypher queries straight to the Neo4j driver with no validation, no statement-type al
Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component
CVE-2026-55437
### Summary The `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted t
Coder's AI Bridge Proxy skips TLS certificate verification in default configuration
CVE-2026-55436
### Summary The AI Bridge Proxy (`aibridgeproxyd`) created a goproxy server whose default transport set `InsecureSkipVe
Suspended Coder users retain access to AI Bridge LLM proxy endpoints
CVE-2026-55435
### Summary AI Bridge proxy endpoints authenticate via `Server.IsAuthorized` in `coderd/aibridgedserver`, which validat
Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints
CVE-2026-55434
### Summary AI Bridge provider handlers read request bodies with `io.ReadAll` without a maximum size so an authenticate
Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers
CVE-2026-55433
### Summary The devcontainer recreate endpoint relied on route middleware that checked only `ActionRead` on the workspa
Coder's sub-agent app registration bypasses template port-sharing policy enforcement
CVE-2026-55432
### Summary The `CreateSubAgent` RPC did not validate a requested app sharing level against the template's `MaxPortShar
Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps
CVE-2026-55431
### Summary `coder open app` opens external workspace-app URLs without validating the scheme or host. When an external
Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service
CVE-2026-55078
### Summary `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-ent
Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator
CVE-2026-55428
### Summary The tailnet coordinator validates that an agent's `Addresses` derive from its authenticated UUID but applie
Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID
CVE-2026-55429
### Summary `UpsertWorkspaceApp` overwrites an existing app's `agent_id` on a primary-key conflict and `insertAgentApp`
Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service
CVE-2026-55079
### Summary `NewDataBuilder` in `provisionersdk/proto/dataupload.go` allocated a byte slice using the client-supplied `
Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`
CVE-2026-55427
### Summary `coder config-ssh` wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user'
Coder: User-admin role can reset owner account password
CVE-2026-55077
### Summary The `PUT /api/v2/users/{user}/password` endpoint authorized only `ActionUpdatePersonal` and did not prevent
Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
CVE-2026-55075
### Summary Two flaws in Coder's OIDC login chained into account takeover: email-based user matching fell back to linki