#CVE

共收录 64179 条相关情报。

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-...

CVE-2026-56835

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its

来源摘录 · NVD

#cve #cwe-862 #cwe-863

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get...

CVE-2026-56834

PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discov

来源摘录 · NVD

#cve #cwe-200 #cwe-22

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any late...

CVE-2026-56832

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval app

来源摘录 · NVD

#cve #cwe-345 #cwe-863

漏洞预警2026-10-23 发布HIGH

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without...

CVE-2026-115726

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committin

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-23 发布MEDIUM

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_i...

CVE-2026-115725

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access oth

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-23 发布LOW

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovi...

CVE-2026-115724

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts c

来源摘录 · NVD

#cve #cwe-346

漏洞预警2026-10-23 发布MEDIUM

RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers...

CVE-2026-115722

RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts

来源摘录 · NVD

#cve #cwe-129

漏洞预警2026-10-23 发布HIGH

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functio...

CVE-2026-112904

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.

来源摘录 · NVD

#cve #cwe-26

漏洞预警2026-10-23 发布INFO

Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, inc...

CVE-2026-107685

Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path a

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-23 发布INFO

`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by...

CVE-2026-89320

`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message unde

来源摘录 · NVD

#cve #cwe-354

漏洞预警2026-10-23 发布INFO

`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `bina...

CVE-2026-89319

`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used

来源摘录 · NVD

#cve #cwe-129

漏洞预警2026-10-23 发布INFO

`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library panics rather th...

CVE-2026-89318

`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking

来源摘录 · NVD

#cve #cwe-248

漏洞预警2026-10-23 发布INFO

gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters ...

CVE-2026-89317

gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to

来源摘录 · NVD

#cve #cwe-1288 #cwe-20 #cwe-347

漏洞预警2026-10-23 发布INFO

`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"` — w...

CVE-2026-89316

`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK

来源摘录 · NVD

#cve #cwe-248

漏洞预警2026-10-23 发布INFO

`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.StructOf` panics ...

CVE-2026-89315

`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimNam

来源摘录 · NVD

#cve #cwe-248

漏洞预警2026-10-23 发布INFO

`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the square of the entry count. Because the ch...

CVE-2026-89314

`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost gr

来源摘录 · NVD

#cve #cwe-407

漏洞预警2026-10-23 发布INFO

`JwksTrustStore.Get` assigned each parsed key to the function's named return value while refreshing the JWKS cache. When the requested `kid` was not present, the trailing na...

CVE-2026-89313

`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache.

来源摘录 · NVD

#cve #cwe-706

漏洞预警2026-10-23 发布INFO

`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library panics rather than returning an error...

CVE-2026-89312

`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go s

来源摘录 · NVD

#cve #cwe-248

漏洞预警2026-10-23 发布CRITICAL

Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value...

CVE-2026-25784

Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image blues

来源摘录 · NVD

#cve #cwe-1188 #cwe-269

漏洞预警2026-10-23 发布HIGH

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock a...

CVE-2026-25716

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authentica

来源摘录 · NVD

#cve #cwe-862