Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL
CVE-2026-53536
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endp
2026-07-18 归档
今日共收录 1491 条安全情报，包含 418 个 CVE，581 篇安全通告，以及 194 篇研究论文。
← 返回归档列表Frogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL execution
CVE-2026-46515
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call
Frogman: Dialplan template parameters interpolated into extensions_custom.conf without escaping
CVE-2026-46512
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template para
Frogman: API tokens stored in plaintext
CVE-2026-46513
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by T
Frogman: Plaintext passwords and secrets persisted to audit log
CVE-2026-46514
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword
BigBlueButton API checksum bypass via presentationUploadExternalUrl
CVE-2026-46353
BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a
BigBlueButton: Presentation URL Security Hardening
CVE-2026-46404
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly res
BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them
CVE-2026-46351
BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web generated conference sessionToken values wit
Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string
CVE-2026-46377
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.1
Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal
CVE-2026-46378
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.1
dbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is Enabled
CVE-2026-44969
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/
dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without Redaction
CVE-2026-44970
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_call
dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters
CVE-2026-44968
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/
Manyfold: Authenticated Path Traversal via File Rename
CVE-2026-46336
Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on
HireFlow: Use of Hard-coded Credentials
CVE-2026-45336
HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring
Emlog Local File Inclusion (LFI)
CVE-2026-46687
Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-t
Emlog Reflected Cross-Site Scripting
CVE-2026-46686
Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword p
Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
CVE-2026-46341
The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
CVE-2026-45367
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7,
zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths
CVE-2026-45568
zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Fl