JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths
CVE-2026-108866
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any accou
2026-10-12 归档
今日共收录 1168 条安全情报，包含 403 个 CVE，452 篇安全通告，以及 67 篇研究论文。
← 返回归档列表zhayujie CowAgent Media Download memory allocation
CVE-2026-108683
A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function
iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint
CVE-2026-108864
iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated
Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface
CVE-2026-108863
Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attack
APIPark through 1.9.7-beta IDOR via application authorization endpoints
CVE-2026-108862
APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to
Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool
CVE-2026-108861
Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the fiel
UnicomAI Wanwu through 0.6.5 Authorization Bypass via /v1/appspace/app/key AppKey Minting
CVE-2026-108856
UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppK
UnicomAI Wanwu through 0.6.5 Missing Authorization via DELETE /v1/appspace/app/publish
CVE-2026-108855
UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user t
Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key
CVE-2026-108854
Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user
Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass
CVE-2026-108852
Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links
Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup
CVE-2026-108850
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated at
thClaws through 0.141.0 Symlink Following File Write via POST /v1/inputs
CVE-2026-108839
thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs
hyper-mcp through 0.8.3 OCI Plugin Signature Verification TOCTOU Race Condition
CVE-2026-108698
hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that veri
CoreShop through 2026.2.2 Missing Authorization via ResourceController listAction
CVE-2026-108697
CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to lis
LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces
CVE-2026-108760
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0
mistral.rs 0.9.0 through 0.9.4 Sandbox Escape via Symlink Following in mistralrs-code-exec
CVE-2026-108759
mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shel
Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint
CVE-2026-108758
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauth
Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint
CVE-2026-108755
Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated att
GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger
CVE-2026-108754
GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger
JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen
CVE-2026-108752
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite ano