Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests
## Summary Cloudreve exposes two admin node test endpoints under the `Admin.Read` OAuth scope. These endpoints accept a
2026-07-25 归档
今日共收录 771 条安全情报，包含 0 个 CVE，408 篇安全通告，以及 82 篇研究论文。
← 返回归档列表Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
# Budibase: SSRF via bare fetch() in uploadUrl during AI table generation ## Summary The `uploadUrl()` function in `pa
Budibase: SSRF via DNS rebinding in the REST datasource integration
### Summary Budibase's central outbound-fetch guard (`fetchWithBlacklist`) prevents SSRF/DNS-rebinding by resolving the
Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
## Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and re
Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
#### Summary The Budibase Worker service exposes a public, unauthenticated API endpoint (`GET /api/global/users/tenant/:
Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
### Summary Budibase's OIDC SSO login links an incoming SSO identity to an existing Budibase account **by email address
Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
## Summary When creating a MongoDB datasource, Budibase passes the `tlsCertificateKeyFile` and `tlsCAFile` fields straig
Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
## Summary The `/api/users/metadata` and `/api/users/metadata/:id` endpoints in `@budibase/server` return full global u
无人机开源飞控 PX4-Autopilot堆栈溢出漏洞 CVE-2025-15150
CVE-2025-15150
无人机开源飞控 PX4-Autopilot堆栈溢出漏洞 CVE-2025-15150
MongoDB内存泄漏 CVE-2025-14847(MongoBleed)
CVE-2025-14847
MongoDB内存泄漏 CVE-2025-14847(MongoBleed)
1Panel 代理证书验证绕过导致任意命令执行漏洞(CVE-2025-54424)
CVE-2025-54424
1Panel 代理证书验证绕过导致任意命令执行漏洞(CVE-2025-54424)
ModelContext Inspector 未授权访问漏洞(CVE-2025-49596)
CVE-2025-49596
ModelContext Inspector 未授权访问漏洞(CVE-2025-49596)
llamaindex SQL 注入漏洞(CVE-2025-1750)
CVE-2025-1750
llamaindex SQL 注入漏洞(CVE-2025-1750)
Screen 本地权限提升漏洞(CVE-2025-23395)
CVE-2025-23395
Screen 本地权限提升漏洞(CVE-2025-23395)
Zabbix认证后SQL注入漏洞(CVE-2024-42327)
CVE-2024-42327
Zabbix认证后SQL注入漏洞(CVE-2024-42327)
ProjectSend认证绕过漏洞(CVE-2024-11680)
CVE-2024-11680
ProjectSend认证绕过漏洞(CVE-2024-11680)
PyTorch库RPC框架反序列化RCE漏洞(CVE-2024-48063)
CVE-2024-48063
PyTorch库RPC框架反序列化RCE漏洞(CVE-2024-48063)
Grafana认证后DuckDB-SQL注入漏洞(CVE-2024-9264)
CVE-2024-9264
Grafana认证后DuckDB-SQL注入漏洞(CVE-2024-9264)
SPIP BigUp Unauthenticated RCE(CVE-2024-8517)
CVE-2024-8517
SPIP BigUp Unauthenticated RCE(CVE-2024-8517)
Rejetto HFS 远程命令执行漏洞(CVE-2024-39943)
CVE-2024-39943
Rejetto HFS 远程命令执行漏洞(CVE-2024-39943)