2026-07-10 归档

今日共收录 1398 条安全情报,包含 466 个 CVE,522 篇安全通告,以及 115 篇研究论文。

← 返回归档列表
安全公告2026-07-09 发布INFO

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

CVE-2026-59223

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, WEB_FETCH_FILTER_

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

Open5GS AMF context.c amf_context_final use after free

CVE-2026-15194

A security flaw has been discovered in Open5GS 2.7.7. This affects the function amf_context_final of the file src/amf/co

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

CVE-2026-59222

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

CVE-2026-59215

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread pa

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

CVE-2026-59216

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call de

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

CVE-2026-59219

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redi

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

mettle sendportal APIv1 Webhooks mailjet missing authentication

CVE-2026-15192

A vulnerability has been found in mettle sendportal up to 3.0.1. This issue affects the function sendgrid/postmark/posta

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

CVE-2026-59715

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Soc

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

gpsd gpsprof Command Injection via gnuplot plot title subtype field

CVE-2026-58459

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

CVE-2026-59220

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.2 before 0.10.0, the SKIL

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

CVE-2026-59226

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute_

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

mettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorization

CVE-2026-15191

A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettl

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

CVE-2026-59227

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 before 0.10.0, POST /a

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

Open WebUI: Account enumeration via observable login timing discrepancy

CVE-2026-59218

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the /api/v1/auths

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

Open WebUI: Stored web worker XSS via Pyodide

CVE-2026-59214

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs c

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

CVE-2026-59209

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration

CVE-2026-59206

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with t

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

CVE-2026-59207

n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents feature did not enforce th

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

Cesanta Mongoose < 7.22 Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing

CVE-2026-11404

Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

enquirer Public Package API Enquirer.set prototype pollution

CVE-2026-15187

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Publ

历史摘要 · 未重新核验 · OSV.dev