#CVE

共收录 70327 条相关情报。

漏洞预警2026-10-20 发布LOW

This issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to bypas...

CVE-2026-84490

This issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker wit

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-20 发布INFO

Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full s...

CVE-2026-77938

Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server sec

历史摘要 · 未重新核验 · NVD

#cve #cwe-526

漏洞预警2026-10-20 发布INFO

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attacke...

CVE-2026-77937

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it expo...

CVE-2026-77936

Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never

历史摘要 · 未重新核验 · NVD

#cve #cwe-1188

漏洞预警2026-10-20 发布INFO

Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplyin...

CVE-2026-77935

Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 ...

CVE-2026-77934

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands

历史摘要 · 未重新核验 · NVD

#cve #cwe-1188

漏洞预警2026-10-20 发布INFO

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all inter...

CVE-2026-77933

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static

历史摘要 · 未重新核验 · NVD

#cve #cwe-1392

漏洞预警2026-10-20 发布INFO

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers functio...

CVE-2026-77932

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agen

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-20 发布INFO

EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an inte...

CVE-2026-77930

EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell comman

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-20 发布INFO

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated ...

CVE-2026-77926

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating s

历史摘要 · 未重新核验 · NVD

#cve #cwe-749

漏洞预警2026-10-20 发布INFO

Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell t...

CVE-2026-75128

Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name with

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-20 发布MEDIUM

A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause une...

CVE-2026-65396

A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoi

来源摘录 · NVD

#cve #cwe-119

漏洞预警2026-10-20 发布MEDIUM

The issue was addressed with improved handling of secure input state. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to ac...

CVE-2026-65379

The issue was addressed with improved handling of secure input state. This issue is fixed in macOS Golden Gate 27, macOS

来源摘录 · NVD

#cve #cwe-200 #cwe-284

漏洞预警2026-10-20 发布MEDIUM

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able...

CVE-2026-65372

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15

来源摘录 · NVD

#cve #cwe-362

漏洞预警2026-10-20 发布MEDIUM

An access issue was addressed with improved access controls. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sens...

CVE-2026-65356

An access issue was addressed with improved access controls. This issue is fixed in macOS Golden Gate 27, macOS Sequoia

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-20 发布HIGH

The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Golden Gate 27. A maliciously modified app may not be prevented from launching.

CVE-2026-28854

The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Golden Gate 27. A mali

来源摘录 · NVD

#cve #cwe-353 #cwe-354

漏洞预警2026-10-20 发布HIGH

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.

CVE-2026-28853

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-20 发布MEDIUM

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.8, visionOS 27. An app may be able to access sensitive user data.

CVE-2026-28850

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.8, visionOS

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-20 发布INFO

OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless prese...

CVE-2026-109444

OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-20 发布INFO

JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copil...

CVE-2026-109443

JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating

历史摘要 · 未重新核验 · NVD

#cve #cwe-653