PraisonAI before 4.6.78 Missing Webhook Signature Verification
CVE-2026-61436
PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated atta
2026-07-16 归档
今日共收录 1958 条安全情报，包含 992 个 CVE，550 篇安全通告，以及 113 篇研究论文。
← 返回归档列表PraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing
CVE-2026-61435
PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints (src/praisonai/prai
PraisonAI before 4.6.78 Code Injection via API deployment generator
CVE-2026-61433
PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for AP
PraisonAI before 4.6.78 Authentication Bypass via HTTP-stream
CVE-2026-61427
PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key optio
PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess Sandbox
CVE-2026-60085
PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend w
n8n - Permission Bypass via Expression Parser Mismatch in External Secrets
CVE-2026-59259
n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling
n8n - External Secrets Disclosure via Workflow Node Expressions
CVE-2026-59254
n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in wo
Grav Flex Objects - Server-Side Template Injection via Dynamic Titles
CVE-2026-58655
The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side templ
phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add Endpoint
CVE-2026-57996
phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAd
Hono - Timing Attack in basicAuth and bearerAuth Middleware
CVE-2026-56764
Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-consta
Wazuh Manager - NDJSON Injection in inventory_sync via Agent-Controlled DataValue.index
CVE-2026-56699
Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, a
open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation
CVE-2026-56400
open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow
Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI
CVE-2026-56398
Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the
ImageMagick - Memory Leak in ASHLAR Coder Action Failure
CVE-2026-56375
ImageMagick through 7.1.2-18 contains a memory leak vulnerability in the ASHLAR coder when an action fails. Attackers ca
n8n - Authentication Bypass in Chat Trigger Node
CVE-2026-56353
n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configu
n8n - Arbitrary File Read and Execution via ExecuteWorkflow localFile Parameter
CVE-2026-56352
n8n before 2.19.3 contains a file path restriction bypass in the legacy ExecuteWorkflow node's localFile source option,
n8n - Guardrail Node Bypass via Crafted Input
CVE-2026-56349
n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypa
Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC
CVE-2026-56339
Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY
Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts
CVE-2026-59235
Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListContro
Apache Fineract: Office list: SQL Injection via Subquery in orderBy
CVE-2026-57821
A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and