JFrog Artifactory contains an authentication weakness that, under default configuration, may...
CVE-2026-82329
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated at
#advisory
共收录 23717 条相关情报。
← 返回所有主题Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any...
CVE-2026-82289
Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab.,
StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail...
CVE-2026-82306
StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfi
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image...
CVE-2026-82343
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing...
CVE-2026-82291
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cros
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE...
CVE-2026-82290
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attac
Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history...
CVE-2026-82284
Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api...
CVE-2026-82285
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/call
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to...
CVE-2026-82287
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions b
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers,...
CVE-2026-82283
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users t
gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl...
CVE-2026-82286
gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthent
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the ...
CVE-2026-82288
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing...
CVE-2026-82282
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to acce
StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler...
CVE-2026-82276
StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override exec
BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once...
CVE-2026-82278
BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authen
Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that...
CVE-2026-82275
Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file acc
arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset
CVE-2026-55678
## Summary Arc Enterprise clustering accepts cluster join requests without authentication when `cluster.enabled=true` b
Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances
CVE-2026-55761
## Summary Portainer supports restoring an instance from a backup archive via the /api/restore endpoint. This endpoint i
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits
CVE-2026-55763
## Summary In `processPercentageRoyaltiesTransfer` the royalty pool is collected from the sender by `SubFromBalance` tha
PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI
CVE-2026-55891
## Vulnerability Details A reflected JSON injection allows an attacker to return arbitrary data in the JSON endpoints (