Flowise through 3.1.4 Missing Authorization via Chat Message Routes
CVE-2026-100605
Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API k
#advisory
共收录 23334 条相关情报。
← 返回所有主题cgroup: Avoid iteration of dying tasks with zero refcount
CVE-2026-98163
In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero re
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
CVE-2026-57443
### Summary The AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email
mpp vulnerable to Gas Draining with low gas limit
## Vulnerability When the server acts as the fee payer, `mpp` Elixir 0.4.0 (ZenHive/mpp) does not validate whether the `
mpp vulnerable to Gas Draining with access list
### Details When the server acts as the fee_payer, `mpp` Elixir 0.4.0 copies the client-supplied EIP-2930 access list ve
mpp vulnerable to Gas Draining with no limit
### Details When the server acts as the fee_payer, the `mpp` Elixir 0.4.0 does not validate `gas_limit`, `max_fee_per_ga
CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers
CVE-2026-100368
### Impact An OS command injection vulnerability exists in the PowerShell and Cmd shell wrappers provided by the `CliInv
CliInvoke: Argument Injection in Extensibility Runner Factory
CVE-2026-100369
### Impact An argument-injection vulnerability exists in the `CliInvoke` package's runner factory: `RunnerProcessFactory
khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem
### Summary The `/home/{file_path:path}` endpoint in `web_client.py` serves static files by directly concatenating the u
Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools
CVE-2026-86439
## Overview Verified. Multiple **Unrestricted Path Traversal** vulnerabilities exist in the Knowns MCP `docs` and `memo
OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet
### Impact Two locations consume an encrypted handle returned by an untrusted external party and use it without verifyi
Containerd has image-pull DoS via crafted OCI index graph amplification
CVE-2026-53493
### Impact A vulnerability exists in containerd's image pull handlers where a crafted OCI image index containing deeply
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI)...
CVE-2026-97730
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dash
MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears...
CVE-2026-97731
MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied
madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the...
CVE-2026-97723
madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the chat message rendering fu
A vulnerability has been found in ningzichun student-management-system up to...
CVE-2026-97650
A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. A
A flaw has been found in ningzichun student-management-system up to...
CVE-2026-97649
A flaw has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected b
A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2...
CVE-2026-97724
A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlle
Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public...
CVE-2026-92289
Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKC
Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0...
CVE-2026-95811
Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl