langgenius dify Splash Layout splash.tsx router.replace cross site scripting
CVE-2026-85021
A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(s
#advisory
共收录 23717 条相关情报。
← 返回所有主题OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods
CVE-2026-73667
### Summary OpenChoreo Workflow Plane templates were vulnerable to OS command injection because some developer-controlle
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
CVE-2026-73840
## Summary The OpenChoreo autobuild webhook endpoint (`POST /api/v1alpha1/autobuild`) selected the git provider used to
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints
CVE-2026-73841
### Summary The OpenChoreo API server (`openchoreo-api`) authorized requests to its exec and wirelogs endpoints against
OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs
CVE-2026-73843
### Summary The OpenChoreo control-plane **cluster-gateway** served its caller-facing management APIs on the same networ
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
CVE-2026-67445
## Summary Mailpit's SMTP server reads each command line with an unbounded `bufio.Reader.ReadString('\n')` before parsi
SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
CVE-2026-72921
### Impact When a filer JWT restricts a token to a set of path prefixes via `allowed_prefixes`, the authorization check
Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling
CVE-2026-67446
## Summary Mailpit's thumbnail endpoint decodes attacker-supplied image attachments into a full raster before checking
Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default
CVE-2026-84366
### Problem Scrapy’s `S3DownloadHandler` sends signed S3 requests over plaintext HTTP by default. A normal request lik
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
CVE-2026-68921
## Summary `@dicebear/core` builds avatar SVGs from caller-supplied options. The numeric `rotate` option is interpolate
Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
CVE-2026-62676
**Reporter:** Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) **Project:** `omnigent-ai/om
Plate: SSRF with response disclosure in DOCX image embedding
CVE-2026-65842
## Summary `@platejs/docx-io` can fetch remote image URLs while converting HTML to DOCX. When an application converts a
Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
CVE-2026-63490
### Summary `com.github.jknack.handlebars.springmvc.SpringTemplateLoader` resolves Spring MVC view names into URLs via S
Hurl: Cookies in Cookies section leak when redirecting to a different host
CVE-2026-63481
## The Bug Hurl <= 8.0.1 lets you define cookies two ways in a .hurl file: 1. As a raw Cookie: header in the [Header]/
Mail: Email address spoofing via malformed RFC 2047 encoded-words
CVE-2026-63435
## Summary Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-wo
Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
CVE-2026-62669
### Summary When 2FA is enabled on an account, submitting correct credentials authenticates the user but leaves them una
Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
CVE-2026-62677
### Summary An authenticated, non-admin user can obtain **arbitrary host-filesystem read/write** (and host environment-
Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE
CVE-2026-62674
### Summary An authenticated user with edit access to their own session can overwrite a shared/template agent by upload
Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools
CVE-2026-62675
### Summary An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. Th
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
CVE-2026-61842
### Summary The Twig content sandbox replaces `config` with the redacted `SandboxConfig` facade and strips `Config::get