2026-10-12 归档

今日共收录 1168 条安全情报，包含 403 个 CVE，452 篇安全通告，以及 67 篇研究论文。

漏洞预警2026-10-11 发布INFO

A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipulation ca...

CVE-2026-108682

A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /

历史摘要 · 未重新核验 · NVD

#cve #cwe-404

漏洞预警2026-10-11 发布INFO

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflo...

CVE-2026-108864

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-11 发布INFO

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound t...

CVE-2026-108863

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-11 发布INFO

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a fore...

CVE-2026-108862

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-11 发布INFO

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attacker...

CVE-2026-108861

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the fiel

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-11 发布INFO

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending overs...

CVE-2026-108859

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote una

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-10-11 发布INFO

UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspa...

CVE-2026-108856

UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppK

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-11 发布INFO

UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the ...

CVE-2026-108855

UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user t

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a num...

CVE-2026-108854

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-11 发布INFO

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG appli...

CVE-2026-108853

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-pri

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-11 发布INFO

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable li...

CVE-2026-108852

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-11 发布INFO

phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDa...

CVE-2026-108851

phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescap...

CVE-2026-108850

Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated at

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-11 发布INFO

thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by fol...

CVE-2026-108839

thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-11 发布INFO

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accept...

CVE-2026-108699

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load maliciou

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-10-11 发布INFO

hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag ra...

CVE-2026-108698

hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that veri

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-10-11 发布INFO

CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceControl...

CVE-2026-108697

CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to lis

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-11 发布INFO

A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py of the component Web Console. The ma...

CVE-2026-108681

A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channe

历史摘要 · 未重新核验 · NVD

#cve #cwe-404

漏洞预警2026-10-11 发布INFO

LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HO...

CVE-2026-108760

LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-1327

漏洞预警2026-10-11 发布INFO

mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite files outside the sandbox vi...

CVE-2026-108759

mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shel

历史摘要 · 未重新核验 · NVD

#cve #cwe-59