AshAi echoes raw tool exception messages into the conversation, disclosing internal details
CVE-2026-82580
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal erro
2026-09-01 归档
今日共收录 1266 条安全情报，包含 424 个 CVE，451 篇安全通告，以及 107 篇研究论文。
← 返回归档列表AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service
CVE-2026-82579
Loop with Unreachable Exit Condition (Infinite Loop) vulnerability in ash-project ash_ai allows an attacker who can infl
EEx template evaluation of prompt content in AshAi enables remote code execution
CVE-2026-77956
Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthentic
LatencyUtils PauseDetector LatencyStats.java LatencyStats.recordDetectedPause memory corruption
CVE-2026-82596
A vulnerability was determined in LatencyUtils up to 2.0.3. Affected by this issue is the function LatencyStats.recordDe
Open Asset Import Library Assimp MD5Loader.cpp MakeDataUnique heap-based overflow
CVE-2026-82591
A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. The impacted element is the
Open5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion
CVE-2026-82590
A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smf_nudm_sdm_handle_get of t
Open5GS N1-N2 Message namf-handler.c amf_namf_comm_handle_n1_n2_message_transfer denial of service
CVE-2026-82589
A security flaw has been discovered in Open5GS up to 2.7.7. Impacted is the function amf_namf_comm_handle_n1_n2_message_
Open5GS Transfer Endpoint namf-handler.c null pointer dereference
CVE-2026-82588
A vulnerability was identified in Open5GS up to 2.7.7. This issue affects some unknown processing of the file src/amf/na
Open5GS AMF namf-handler.c amf_namf_comm_decode_ue_mm_context_list memory corruption
CVE-2026-82587
A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function amf_namf_comm_decode_ue_m
Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names
CVE-2026-78693
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote cl
Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read
CVE-2026-80223
Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to rec
Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment
CVE-2026-81633
Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay nod
Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification
CVE-2026-81643
Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a su
A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory trave...
CVE-2026-67395
A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validati
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of th...
CVE-2026-82957
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptio
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check fro...
CVE-2026-82395
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8,
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard rou...
CVE-2026-81892
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin s
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but che...
CVE-2026-54599
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OI
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update_exchange.php loads the first Fixer/API Layer credential ...
CVE-2026-50199
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update
net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor a...
CVE-2026-14697
net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When it is call