Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any...
CVE-2026-108854
Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user
#advisory
共收录 23075 条相关情报。
← 返回所有主题thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the...
CVE-2026-108839
thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs
UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows...
CVE-2026-108856
UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppK
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that...
CVE-2026-108850
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated at
phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server...
CVE-2026-108851
phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP
Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication...
CVE-2026-108757
Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-r
Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram...
CVE-2026-108756
Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host...
CVE-2026-108753
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which s
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking:...
CVE-2026-108758
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauth
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its...
CVE-2026-108760
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0
GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys...
CVE-2026-108754
GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger
CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low...
CVE-2026-108697
CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to lis
pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header
CVE-2026-108905
pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allo
pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController
CVE-2026-108904
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API client
pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID
CVE-2026-108903
pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated att
pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link
CVE-2026-108902
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePho
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId
CVE-2026-108891
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId ha
JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls
CVE-2026-108888
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler
JeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls
CVE-2026-108887
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler tha
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername
CVE-2026-108886
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername