今日共收录 1726 条安全情报，包含 665 个 CVE，657 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-85694
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that eval
CVE-2026-85693
Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers
CVE-2026-85692
Nightingale (n9e), as of commit 8362cbe (main branch, confirmed 2026-08-27), contains a server-side request forgery vuln
CVE-2026-85691
MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that
CVE-2026-85690
Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files ou
CVE-2026-85689
llmware 0.4.6 contains an SQL injection vulnerability in the collection-database layer (llmware/resources.py) where filt
CVE-2026-85687
surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /p
CVE-2026-85686
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetch
CVE-2026-85685
AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary
CVE-2026-85676
Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link withou
CVE-2026-85675
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content too
CVE-2026-85674
aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is la
CVE-2026-85673
LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL han
CVE-2026-85670
tokenizers (Hugging Face) is affected by an out-of-bounds buffer access in BpeBuilder::build (tokenizers/src/models/bpe/
CVE-2026-85669
potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpo
CVE-2026-85668
Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vulnerability in the POS
CVE-2026-85666
OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerabi
CVE-2026-85665
Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitr
CVE-2026-85664
Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in
CVE-2026-85662
Marqo 2.26.0 contains a server-side request forgery vulnerability in the add_documents endpoint that allows unauthentica