#CVE

共收录 63886 条相关情报。

漏洞预警2026-10-23 发布LOW

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using tra...

CVE-2026-115751

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows att

来源摘录 · NVD

#cve #cwe-184

漏洞预警2026-10-23 发布LOW

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwa...

CVE-2026-115750

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture A

来源摘录 · NVD

#cve #cwe-522

漏洞预警2026-10-23 发布LOW

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. ...

CVE-2026-115730

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation

来源摘录 · NVD

#cve #cwe-74

漏洞预警2026-10-23 发布MEDIUM

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attac...

CVE-2026-115729

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to byp

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-23 发布INFO

A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client...

CVE-2026-95620

A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a m

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the appro...

CVE-2026-56840

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval render

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explici...

CVE-2026-56838

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks

来源摘录 · NVD

#cve #cwe-693 #cwe-78 #cwe-863

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe ...

CVE-2026-56836

PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console en

来源摘录 · NVD

#cve #cwe-287 #cwe-306 #cwe-862

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-...

CVE-2026-56835

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its

来源摘录 · NVD

#cve #cwe-862 #cwe-863

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get...

CVE-2026-56834

PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discov

来源摘录 · NVD

#cve #cwe-200 #cwe-22

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any late...

CVE-2026-56832

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval app

来源摘录 · NVD

#cve #cwe-345 #cwe-863

漏洞预警2026-10-23 发布HIGH

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without...

CVE-2026-115726

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committin

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-23 发布MEDIUM

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_i...

CVE-2026-115725

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access oth

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-23 发布LOW

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovi...

CVE-2026-115724

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts c

来源摘录 · NVD

#cve #cwe-346

漏洞预警2026-10-23 发布MEDIUM

RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers...

CVE-2026-115722

RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts

来源摘录 · NVD

#cve #cwe-129

漏洞预警2026-10-23 发布HIGH

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functio...

CVE-2026-112904

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.

来源摘录 · NVD

#cve #cwe-26

漏洞预警2026-10-23 发布INFO

Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, inc...

CVE-2026-107685

Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path a

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-23 发布INFO

`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by...

CVE-2026-89320

`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message unde

来源摘录 · NVD

#cve #cwe-354

漏洞预警2026-10-23 发布INFO

`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `bina...

CVE-2026-89319

`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used

来源摘录 · NVD

#cve #cwe-129

漏洞预警2026-10-23 发布INFO

`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library panics rather th...

CVE-2026-89318

`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking

来源摘录 · NVD

#cve #cwe-248