pg_partman authorization bypass to move child tables between schemas during retention

CVE-2026-61821

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id()

历史摘要 · 未重新核验 · OSV.dev

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

CVE-2026-77528

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, We

历史摘要 · 未重新核验 · OSV.dev

vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs

CVE-2026-93841

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs ind

历史摘要 · 未重新核验 · OSV.dev

vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids

CVE-2026-93840

vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in Sampling

历史摘要 · 未重新核验 · OSV.dev

LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint

CVE-2026-93839

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allow

历史摘要 · 未重新核验 · OSV.dev

Saleor throttling.py get_client_ip excessive authentication

CVE-2026-93650

A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function

历史摘要 · 未重新核验 · OSV.dev

Obot: Server-Side Request Forgery via remote MCP server URL

## Summary In affected versions, the URL of a remote MCP server is attacker-controlled at registration and is fetched s

历史摘要 · 未重新核验 · GitHub Advisory

Obot: MCP Registry API readable without authentication

## Summary In affected versions, enabling registry authentication (`OBOT_SERVER_ENABLE_REGISTRY_AUTH=true`) does not ac

历史摘要 · 未重新核验 · GitHub Advisory

Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion

## Summary In affected versions, an unauthenticated attacker could register an OAuth client with an arbitrary external

历史摘要 · 未重新核验 · GitHub Advisory

Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)

CVE-2026-71537

### Summary The service downgrade implementation in `app/Livewire/Services/Upgrade.php::doUpgrade()` executes a prorati

历史摘要 · 未重新核验 · GitHub Advisory

io.moquette:moquette-broker has a Missing Authorization issue

CVE-2026-85058

## Summary Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will (Last Will and Testam

历史摘要 · 未重新核验 · GitHub Advisory

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

CVE-2026-59163

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_

历史摘要 · 未重新核验 · OSV.dev

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

CVE-2026-59163

### Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SH

历史摘要 · 未重新核验 · GitHub Advisory

deepmerge through 4.3.1 Prototype Poisoning via mergeObject

CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properl

历史摘要 · 未重新核验 · OSV.dev

source-map-js through 1.2.1 Event Loop Denial of Service

CVE-2026-93749

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attacke

历史摘要 · 未重新核验 · OSV.dev

SysReptor: Session Fixation in Password-Protected Shared Notes

CVE-2026-81181

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for pro

历史摘要 · 未重新核验 · OSV.dev

SysReptor: Unauthorized file disclosure by broken access control in writable shared notes

CVE-2026-81182

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a

历史摘要 · 未重新核验 · OSV.dev

SysReptor: Authenticated RCE by insecure image processing

CVE-2026-81180

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Profess

历史摘要 · 未重新核验 · OSV.dev

SysReptor: Host header injection might allow account takeover

CVE-2026-81179

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset

历史摘要 · 未重新核验 · OSV.dev

SysReptor: Anonymous note-share link discloses project member identities and non-shared note activity

CVE-2026-81178

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public no

历史摘要 · 未重新核验 · OSV.dev