heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext...
CVE-2026-100862
heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0
2026-09-27 归档
今日共收录 1038 条安全情报，包含 222 个 CVE，481 篇安全通告，以及 74 篇研究论文。
← 返回归档列表heym before 0.0.105 does not act on the result of the credential authorization lookup in the...
CVE-2026-100860
heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backen
heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map...
CVE-2026-100864
heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback re
Heym before 0.0.53 contains multiple independent vulnerabilities. (1) The workflow condition...
CVE-2026-100865
Heym before 0.0.53 contains multiple independent vulnerabilities. (1) The workflow condition evaluator uses Python eval(
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials...
CVE-2026-100859
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that all
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai...
CVE-2026-100844
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_run
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station...
CVE-2026-100855
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}
AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability...
CVE-2026-100850
AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote pl
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password...
CVE-2026-100856
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete mig
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint...
CVE-2026-100854
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derive
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level...
CVE-2026-100853
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allow
AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of...
CVE-2026-100847
AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListA
MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the...
CVE-2026-100846
MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/
AzuraCast through 0.23.x contains a command injection vulnerability in the Liquidsoap config...
CVE-2026-100852
AzuraCast through 0.23.x contains a command injection vulnerability in the Liquidsoap config generation for live recordi
AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station...
CVE-2026-100849
AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/...
CVE-2026-100851
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint
AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter:...
CVE-2026-100857
AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails t
Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's...
CVE-2026-100836
Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSO
A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown...
CVE-2026-100744
A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Htt
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination...
CVE-2026-100841
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weight