2026-08-29 归档

今日共收录 1687 条安全情报，包含 687 个 CVE，604 篇安全通告，以及 114 篇研究论文。

漏洞预警2026-08-28 发布INFO

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gra...

CVE-2026-82288

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-08-28 发布INFO

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-O...

CVE-2026-82287

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions b

历史摘要 · 未重新核验 · NVD

#cve #cwe-942

漏洞预警2026-08-28 发布INFO

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesyst...

CVE-2026-82286

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthent

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-28 发布INFO

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no UR...

CVE-2026-82285

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/call

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-28 发布INFO

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, ...

CVE-2026-82283

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users t

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-28 发布INFO

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or inter...

CVE-2026-82282

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to acce

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-28 发布INFO

Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py. Attac...

CVE-2026-82281

Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-28 发布INFO

Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared...

CVE-2026-82280

Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-28 发布INFO

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete...

CVE-2026-82279

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team membe

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers...

CVE-2026-82278

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authen

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-28 发布INFO

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing executeWithoutPass...

CVE-2026-82276

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override exec

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-28 发布INFO

Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolut...

CVE-2026-82275

Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file acc

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-28 发布INFO

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirec...

CVE-2026-82274

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback en

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-08-28 发布INFO

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configurati...

CVE-2026-82273

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through share...

CVE-2026-82272

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset e

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-28 发布INFO

R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conversations. Attac...

CVE-2026-82271

R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authen

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-28 发布INFO

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these sec...

CVE-2026-82269

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middl

历史摘要 · 未重新核验 · NVD

#cve #cwe-288

漏洞预警2026-08-28 发布INFO

Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction ...

CVE-2026-82268

Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-28 发布INFO

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authen...

CVE-2026-82267

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission check

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. A...

CVE-2026-82265

Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing una

历史摘要 · 未重新核验 · NVD

#cve #cwe-306