FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token')

CVE-2026-61684

FastGPT is a knowledge-based AI application platform. In 4.15.0-beta4, FastGPT plugin invoke reverse-call endpoints unde

历史摘要 · 未重新核验 · OSV.dev

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

CVE-2026-61736

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=*

历史摘要 · 未重新核验 · OSV.dev

PLANET VDR-300NU ADSL Router - 未授权修改DNS

PLANET VDR-300NU ADSL Router - 未授权修改DNS

历史摘要 · 未重新核验 · 知道创宇 / Seebug

Acknowledgements

Acknowledgements

历史摘要 · 未重新核验 · Android Security Bulletin

【EdgeOne】CNAME 域名生成规则调整公告

【EdgeOne】CNAME 域名生成规则调整公告

历史摘要 · 未重新核验 · 腾讯云安全公告

Credential disclosure in Strands Agents Tools elasticsearch_memory tool

CVE-2026-15746

Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provide

历史摘要 · 未重新核验 · OSV.dev

Cherry Studio RCE via SearchService nodeIntegration Misconfiguration

CVE-2026-40501

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in S

历史摘要 · 未重新核验 · OSV.dev

Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso

CVE-2026-53515

Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/ss

历史摘要 · 未重新核验 · OSV.dev

Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration

CVE-2026-53513

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin'

历史摘要 · 未重新核验 · OSV.dev

Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email

CVE-2026-53516

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback

历史摘要 · 未重新核验 · OSV.dev

Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId

CVE-2025-32781

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior

历史摘要 · 未重新核验 · OSV.dev

Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching

CVE-2026-59954

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior

历史摘要 · 未重新核验 · OSV.dev

Apollo ConfigService access key authentication bypass via raw config file appId parsing

CVE-2026-59955

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior

历史摘要 · 未重新核验 · OSV.dev

Lightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypass

CVE-2026-52842

Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the en

历史摘要 · 未重新核验 · OSV.dev

Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode

CVE-2026-52843

Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest u

历史摘要 · 未重新核验 · OSV.dev

File Browser: Colliding username normalization gives two users the same home directory

CVE-2026-62685

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

历史摘要 · 未重新核验 · OSV.dev

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

CVE-2026-62843

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

历史摘要 · 未重新核验 · OSV.dev

File Browser: Trailing-slash delete leaves a stale public share behind

CVE-2026-62683

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

历史摘要 · 未重新核验 · OSV.dev

Zen Browser - Missing Fullscreen Security Notification Allows Origin Spoofing

CVE-2026-45150

Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security no

历史摘要 · 未重新核验 · OSV.dev

Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity

CVE-2026-47164

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the

历史摘要 · 未重新核验 · OSV.dev