#CVE

共收录 64179 条相关情报。

漏洞预警2026-10-23 发布INFO

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded ...

CVE-2026-57209

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heim

来源摘录 · NVD

#cve #cwe-20 #cwe-74

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming w...

CVE-2026-57146

PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-

来源摘录 · NVD

#cve #cwe-200 #cwe-306

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sa...

CVE-2026-57144

PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbo

来源摘录 · NVD

#cve #cwe-266 #cwe-668 #cwe-693

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-d...

CVE-2026-57142

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a

来源摘录 · NVD

#cve #cwe-78 #cwe-863 #cwe-94

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write...

CVE-2026-57117

PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgen

来源摘录 · NVD

#cve #cwe-78 #cwe-863

漏洞预警2026-10-23 发布CRITICAL

PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and ...

CVE-2026-57116

PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deploy

来源摘录 · NVD

#cve #cwe-200 #cwe-306 #cwe-862

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again w...

CVE-2026-57114

PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API valid

来源摘录 · NVD

#cve #cwe-367 #cwe-918

漏洞预警2026-10-23 发布INFO

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file acc...

CVE-2026-55888

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use th

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-23 发布MEDIUM

conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly...

CVE-2026-55422

conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two Re

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布MEDIUM

Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe() is the SSRF ...

CVE-2026-55190

Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-23 发布INFO

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection informa...

CVE-2026-54711

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to versi

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-10-23 发布MEDIUM

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. At...

CVE-2026-115752

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store i

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-23 发布LOW

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using tra...

CVE-2026-115751

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows att

来源摘录 · NVD

#cve #cwe-184

漏洞预警2026-10-23 发布LOW

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwa...

CVE-2026-115750

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture A

来源摘录 · NVD

#cve #cwe-522

漏洞预警2026-10-23 发布LOW

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. ...

CVE-2026-115730

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation

来源摘录 · NVD

#cve #cwe-74

漏洞预警2026-10-23 发布MEDIUM

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attac...

CVE-2026-115729

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to byp

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-23 发布INFO

A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client...

CVE-2026-95620

A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a m

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the appro...

CVE-2026-56840

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval render

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explici...

CVE-2026-56838

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks

来源摘录 · NVD

#cve #cwe-693 #cwe-78 #cwe-863

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe ...

CVE-2026-56836

PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console en

来源摘录 · NVD

#cve #cwe-287 #cwe-306 #cwe-862