WACRM: SSRF via the automation `send_webhook` action
CVE-2026-67530
WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/
#advisory
共收录 23636 条相关情报。
← 返回所有主题Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController
CVE-2026-67207
Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authentic
OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)
CVE-2026-67529
OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /ap
Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload
CVE-2026-67206
Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticat
OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure
CVE-2026-67528
OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resol
OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"
CVE-2026-67527
OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} acc
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
CVE-2026-66066
Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.
CVE-2026-15969
CVE-2026-15969
SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denyl
CVE-2026-15978
CVE-2026-15978
SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two end
CVE-2026-15977
CVE-2026-15977
SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyf
CVE-2026-15976
CVE-2026-15976
SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically wi
CVE-2026-15974
CVE-2026-15974
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitize
CVE-2026-15971
CVE-2026-15971
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when D
Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware
CVE-2026-66416
Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform stat
Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE
CVE-2026-61536
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool J
Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()
CVE-2026-66415
Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated a
Leantime Open Redirect in Login Controller via redirectUrl Parameter
CVE-2026-66414
Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to
【云数据库】关于云数据库服务条款更新的公告
【云数据库】关于云数据库服务条款更新的公告
【云数据库 MySQL】关于服务等级协议更新的公告
【云数据库 MySQL】关于服务等级协议更新的公告
【数据库备份服务】关于服务等级协议更新的公告
【数据库备份服务】关于服务等级协议更新的公告