VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers,...
CVE-2026-82283
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users t
2026-08-29 归档
今日共收录 1687 条安全情报，包含 687 个 CVE，604 篇安全通告，以及 114 篇研究论文。
← 返回归档列表gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl...
CVE-2026-82286
gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthent
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the ...
CVE-2026-82288
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing...
CVE-2026-82282
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to acce
StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler...
CVE-2026-82276
StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override exec
BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once...
CVE-2026-82278
BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authen
Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that...
CVE-2026-82275
Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file acc
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits
CVE-2026-55763
## Summary In `processPercentageRoyaltiesTransfer` the royalty pool is collected from the sender by `SubFromBalance` tha
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
CVE-2026-55220
## Summary `Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource()` deserializes the `*__hot
Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
CVE-2026-55212
### Summary The Studio API class definition creation endpoint in `pimcore/studio-backend-bundle` is guarded by the `obje
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
CVE-2026-55208
## Summary An authenticated user extracts the admin password hash and any other database content through a time-based b
Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass
CVE-2026-55207
## Summary An unauthenticated attacker takes over any Pimcore admin account by sending a password reset request with an
Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。
Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。
Cookie settings
Cookie settings
Mozilla Monitor
Mozilla Monitor
The Mozilla Manifesto
The Mozilla Manifesto
Mozilla Foundation
Mozilla Foundation
Accessibility Policy
Accessibility Policy
Create an Account
Create an Account
Instructions for subscribing to email notifications
Instructions for subscribing to email notifications