TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath
CVE-2026-48763
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/t
2026-08-13 归档
今日共收录 1881 条安全情报，包含 959 个 CVE，493 篇安全通告，以及 113 篇研究论文。
← 返回归档列表TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding
CVE-2026-48765
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspa
Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC
CVE-2026-63177
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Ng
Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS)
CVE-2026-63133
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives
Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component
CVE-2026-55676
Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `P
FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`
CVE-2026-72745 · CVE-2026-73242
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos
FreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parser
CVE-2026-73235
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constru
GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision
CVE-2026-19091
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to
Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml
CVE-2026-73036
Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt
ffuf denial of service (OOM) via HTTP response decompression bomb
CVE-2026-73232
ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory
Flawfinder output manipulation via untrusted filenames and source text
CVE-2026-48813
Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have a
Open5GS Diameter S6a hss-s6a-path.c hss_ogs_diam_s6a_ulr_cb stack-based overflow
CVE-2024-14042
A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr
DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing
CVE-2026-72742
DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attacke
electerm: Path traversal in editWithSystemEditor temp file path via unsanitized SFTP filename
CVE-2026-73223
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm al
CVAT: Denial of service with regards to automatic annotation
CVE-2026-73219
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user
coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS
CVE-2026-73214
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtls_server_input_handler() and cr
turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
CVE-2026-48790
Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the us
Compatibility Test Suite (CTS)
该公告来自 Android Security Bulletin，内容为 Compatibility Test Suite（CTS）的说明页面。CTS 是 Google 提供的一套兼容性测试工具，用于验证 Android 设备实现是否符合 A
Compatibility Definition Document (CDD)
本公告为 Android 生态系统中的‘兼容性定义文档’（Compatibility Definition Document, CDD）发布页面。CDD 是由 Android 官方维护的一份规范性文档，用于定义 Android 设备必须满足
Tools, build, and related reference
本输入为 Android Security Bulletin 中的一个文档页面，标题为 'Tools, build, and related reference'，来源网址为 https://source.android.com/docs/