Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools
CVE-2026-62675
### Summary An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. Th
2026-09-03 归档
今日共收录 1407 条安全情报，包含 491 个 CVE，487 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
CVE-2026-61690
## Summary `ZipArchiver::extract()` lacks limits on uncompressed size, file count, and nesting depth, creating a distinc
A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability...
CVE-2026-84841
A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The m
A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the...
CVE-2026-84857
A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the c
Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM...
CVE-2023-20576
Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially result
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows...
CVE-2026-75137
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recov
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated...
CVE-2026-82524
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to uplo
A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part...
CVE-2026-84840
A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file Intercepti
A heap overflow in SMM module may allow an attacker with access to a second vulnerability that...
CVE-2023-20577
A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI fl
UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that...
CVE-2026-75136
UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows...
CVE-2026-75135
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recov
SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting...
CVE-2026-75134
SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenti
A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the...
CVE-2026-84856
A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.j
A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is...
CVE-2026-84839
A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionalit
link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
CVE-2026-61704
The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3
A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group...
CVE-2026-77125
A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints
Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability...
CVE-2026-77123
Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account hold
In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1...
CVE-2026-77124
In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that...
CVE-2026-82522
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers
An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1...
CVE-2026-77122
An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) i