2026-07-16 归档

今日共收录 1958 条安全情报，包含 992 个 CVE，550 篇安全通告，以及 113 篇研究论文。

← 返回归档列表

漏洞预警2026-07-15 发布INFO

PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST validation of workflow script steps. ...

CVE-2026-61438

PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-15 发布INFO

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can sen...

CVE-2026-61436

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-07-15 发布INFO

PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints (src/praisonai/praisonai/api/agent_invoke.py) when PRAISONAI_CALL_AUTH=disab...

CVE-2026-61435

PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints (src/praisonai/prai

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-07-15 发布INFO

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressi...

CVE-2026-61433

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for AP

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-15 发布INFO

PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time...

CVE-2026-61430

PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostna

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-15 发布INFO

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authoriz...

CVE-2026-61427

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key optio

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-07-15 发布INFO

PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers ...

CVE-2026-60087

PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-15 发布INFO

PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, al...

CVE-2026-60085

PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend w

历史摘要 · 未重新核验 · NVD

#cve #cwe-273

漏洞预警2026-07-15 发布INFO

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check...

CVE-2026-59259

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-15 发布INFO

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authen...

CVE-2026-59254

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in wo

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-15 发布INFO

Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM before 5.14.0 all...

CVE-2026-59236

Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, Pro

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-15 发布INFO

The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic colle...

CVE-2026-58655

The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side templ

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-15 发布INFO

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin administrators to create SuperAdmin accounts. A deleg...

CVE-2026-57996

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAd

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-07-15 发布INFO

Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function...

CVE-2026-56764

Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-consta

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-07-15 发布INFO

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/func...

CVE-2026-56400

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-07-15 发布INFO

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extensi...

CVE-2026-56398

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-07-15 发布INFO

ImageMagick through 7.1.2-18 contains a memory leak vulnerability in the ASHLAR coder when an action fails. Attackers can trigger failed actions to exhaust memory resources and ...

CVE-2026-56375

ImageMagick through 7.1.2-18 contains a memory leak vulnerability in the ASHLAR coder when an action fails. Attackers ca

历史摘要 · 未重新核验 · NVD

#cve #cwe-401

漏洞预警2026-07-15 发布INFO

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases — before 1.123.22, the 2.0....

CVE-2026-56353

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configu

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-07-15 发布INFO

n8n before 2.19.3 contains a file path restriction bypass in the legacy ExecuteWorkflow node's localFile source option, which reads workflow files from disk without the file-acc...

CVE-2026-56352

n8n before 2.19.3 contains a file path restriction bypass in the legacy ExecuteWorkflow node's localFile source option,

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-15 发布INFO

n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail instructions. End users can craft ma...

CVE-2026-56349

n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypa

历史摘要 · 未重新核验 · NVD

#cve #cwe-20