libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded gri...

CVE-2026-47247

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak p

历史摘要 · 未重新核验 · NVD

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that is affected is 9.3.6. Easily exploit...

CVE-2026-47009

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The su

来源摘录 · NVD

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

### Summary `Repo.clone_from()` passes the caller-supplied remote URL through `Git.polish_url()`, which on every non-Cyg

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Webhook Authorization Header Returned in Plaintext via API

CVE-2026-58511

## Summary The `ToHook()` function in `services/webhook/general.go` decrypts the webhook's `HeaderAuthorizationEncrypte

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

CVE-2026-57897

**Author:** Prakhar Porwal **Date:** 2026-05-24 **Target:** Gitea (self-hosted Git service) **Branch tested:** `main` @

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

CVE-2026-58510

## Summary GHSA-8fwc-qjw5-rvgp ("Gitea may send release notification emails for private repositories to users whose acc

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

CVE-2026-58427

## Summary PR #38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enum

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Notification API leaks private issue metadata after access revocation

CVE-2026-58419

# Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Unauthorized Access to Labels of Private Organizations

CVE-2026-25038

## Summary Gitea 1.26.2 does not properly enforce organization visibility restrictions on organization label read endpo

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

CVE-2026-24451

### Summary The `POST /api/v1/repos/{owner}/{repo}/merge-upstream` endpoint continues to synchronize commits from a par

历史摘要 · 未重新核验 · GitHub Advisory

libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation

CVE-2026-47247

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak p

历史摘要 · 未重新核验 · OSV.dev

An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.

CVE-2026-52474

An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.

历史摘要 · 未重新核验 · NVD

HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security.

CVE-2026-56579

HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed infor

历史摘要 · 未重新核验 · NVD

HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions.

CVE-2026-56578

HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities

历史摘要 · 未重新核验 · NVD

This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0 of Confluence Da...

CVE-2026-21579

This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1,

历史摘要 · 未重新核验 · NVD

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically ex...

CVE-2026-47395

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praiso

历史摘要 · 未重新核验 · NVD

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vu...

CVE-2026-47394

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is in

历史摘要 · 未重新核验 · NVD

HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilities or publicly av...

CVE-2026-56584

HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software

历史摘要 · 未重新核验 · NVD

Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13.

CVE-2026-16405

Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153 and Firefox

历史摘要 · 未重新核验 · NVD

OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers w...

CVE-2026-65009

OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint th

历史摘要 · 未重新核验 · NVD