Ghost: Server-side request forgery via DNS rebinding in external request handling
CVE-2026-53945
### Impact Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacke
2026-08-05 归档
今日共收录 766 条安全情报，包含 0 个 CVE，370 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
CVE-2026-70488
## Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
CVE-2026-70485
## Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and we
Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
CVE-2026-70481
## Summary On standard channels, the message update and delete handlers accepted any caller holding write access on the
Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
CVE-2026-70476
### Summary Several organization billing endpoints accept attacker-controlled Stripe identifiers (subscriptionId) withou
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An...
CVE-2026-49435
Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote att
Alert for CVE-2025-61884
CVE-2025-61884
Alert for CVE-2025-61884
Alert for CVE-2025-61882
CVE-2025-61882
Alert for CVE-2025-61882
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
该公告涉及 Citrix NetScaler 中的一个内存泄漏漏洞（CVE-2025-5777）。Citrix NetScaler 是一款广泛使用的应用交付控制器（ADC），负责负载均衡、应用加速和安全策略实施。根据漏洞库信息，该漏洞被描述
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
2026年8月5日，CrowdStrike 和 Zscaler 联合发布公告，宣布将“连续身份”能力集成到零信任访问解决方案中。该合作旨在将 CrowdStrike 的端点安全与身份保护能力（如 Falcon 平台的实时风险信号）与 Zsc
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 于 2026 年 8 月 5 日发布公告，宣布推出面向 AI 代理的 Continuous Identity（持续身份）功能。该功能旨在应对 AI 代理在自动化工作流中广泛使用所带来的身份与访问管理（IAM）新挑战。
Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
CVE-2026-70494
## Summary A user granted write access to a shared chat folder could permanently delete chats and messages belonging to
Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
CVE-2026-70493
## Summary The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. P
Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
CVE-2026-70491
## Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticate
Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
CVE-2026-70490
## Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP depend
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
CVE-2026-70489
## Summary In every affected release, automation recurrence parsing anchors minutely and hourly rules at a fixed date of
Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
CVE-2026-70487
## Summary Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model