MoAI-ADK through 3.1.2 Symlink Following via moai init Template Deployer
CVE-2026-108751
MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows
2026-10-12 归档
今日共收录 1168 条安全情报，包含 403 个 CVE，452 篇安全通告，以及 67 篇研究论文。
← 返回归档列表OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction
CVE-2026-108750
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust P
docling-serve 1.14.0 through 1.36.0 Missing Authentication via Memory Management Endpoints
CVE-2026-108749
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attacker
Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket
CVE-2026-108748
Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket
Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources
CVE-2026-108746
Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that igno
pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync
CVE-2026-108744
pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pb
Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Checker
CVE-2026-108741
Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra b
GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment
CVE-2026-108740
GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that
Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion
CVE-2026-108737
Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tok
Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing
CVE-2026-108736
Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attack
Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL
CVE-2026-108735
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to rea
Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document
CVE-2026-108734
Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_docume
Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation
CVE-2026-108733
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization
Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
CVE-2026-108732
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization
Raven 2.0.0 through 3.0.0 Missing Authorization via join_workspace Invite-Only Bypass
CVE-2026-108731
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-
Raven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs
CVE-2026-108730
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py
Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoints
CVE-2026-108729
Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows
Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook
CVE-2026-108728
Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to o
GLPI through 12.0.0 Missing Authorization via ajax/map.php
CVE-2026-108726
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privile
Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin
CVE-2026-108725
Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allo