#CVE

共收录 65074 条相关情报。

漏洞预警2026-10-23 发布INFO

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file acc...

CVE-2026-55888

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use th

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-23 发布MEDIUM

conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly...

CVE-2026-55422

conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two Re

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布MEDIUM

Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe() is the SSRF ...

CVE-2026-55190

Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-23 发布INFO

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection informa...

CVE-2026-54711

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to versi

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-10-23 发布MEDIUM

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. At...

CVE-2026-115752

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store i

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-23 发布LOW

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using tra...

CVE-2026-115751

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows att

来源摘录 · NVD

#cve #cwe-184

漏洞预警2026-10-23 发布LOW

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwa...

CVE-2026-115750

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture A

来源摘录 · NVD

#cve #cwe-522

漏洞预警2026-10-23 发布LOW

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. ...

CVE-2026-115730

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation

来源摘录 · NVD

#cve #cwe-74

漏洞预警2026-10-23 发布MEDIUM

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attac...

CVE-2026-115729

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to byp

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-23 发布INFO

A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client...

CVE-2026-95620

A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a m

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the appro...

CVE-2026-56840

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval render

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explici...

CVE-2026-56838

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks

来源摘录 · NVD

#cve #cwe-693 #cwe-78 #cwe-863

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe ...

CVE-2026-56836

PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console en

来源摘录 · NVD

#cve #cwe-287 #cwe-306 #cwe-862

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-...

CVE-2026-56835

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its

来源摘录 · NVD

#cve #cwe-862 #cwe-863

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get...

CVE-2026-56834

PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discov

来源摘录 · NVD

#cve #cwe-200 #cwe-22

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any late...

CVE-2026-56832

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval app

来源摘录 · NVD

#cve #cwe-345 #cwe-863

漏洞预警2026-10-23 发布HIGH

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without...

CVE-2026-115726

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committin

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-23 发布MEDIUM

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_i...

CVE-2026-115725

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access oth

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-23 发布LOW

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovi...

CVE-2026-115724

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts c

来源摘录 · NVD

#cve #cwe-346

漏洞预警2026-10-23 发布MEDIUM

RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers...

CVE-2026-115722

RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts

来源摘录 · NVD

#cve #cwe-129