AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.12.1, GET /api/workspace/:slug/tts...

CVE-2026-42456

AnythingLLM 是一个将内容片段转化为 LLM 聊天参考上下文的应用程序。在 1.12.1 版本之前，GET /api/workspace/:slug/tts/:chatId 接口存在不安全的直接对象引用（IDOR）漏洞。该路由仅验

历史摘要 · 未重新核验 · NVD

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, the output of cilium-bugtool can contai...

CVE-2026-41520

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.

历史摘要 · 未重新核验 · NVD

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, the inc "filename" directive i...

CVE-2026-42213

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.

历史摘要 · 未重新核验 · NVD

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab serve...

CVE-2026-42195

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts

历史摘要 · 未重新核验 · NVD

Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

CVE-2026-44557

# Global Knowledge Base Enumeration via knowledge-bases Meta-Collection ## Affected Component Retrieval collection acc

历史摘要 · 未重新核验 · GitHub Advisory

Electerm's full process.env exposed to renderer via window.pre.env

CVE-2026-43942

### Impact The `getConstants()` IPC handler in `src/app/lib/ipc-sync.js` serialises the entire `process.env` object and

历史摘要 · 未重新核验 · GitHub Advisory

Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects Apache CloudStack: from 4.21.0.0 through 4...

CVE-2026-25199

Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This

历史摘要 · 未重新核验 · NVD

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/app/lib/ipc-sync.js...

CVE-2026-43942

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior,

历史摘要 · 未重新核验 · NVD

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized...

CVE-2026-42826

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose i

历史摘要 · 未重新核验 · GitHub Advisory

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and da...

CVE-2026-42880

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0

历史摘要 · 未重新核验 · NVD

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network.

CVE-2026-42826

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose i

历史摘要 · 未重新核验 · NVD

Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orchestration. Versions 3.22.0 through 3.53.1 contain a vulner...

CVE-2026-42047

Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orche

历史摘要 · 未重新核验 · NVD

Ech0 comment model's Email field returned on public /api/comments endpoints

## Summary The `Comment` model serializes its `Email` field through the public comment-listing API. `internal/model/com

历史摘要 · 未重新核验 · GitHub Advisory

FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint

CVE-2026-42878

### Summary An unauthenticated information disclosure vulnerability in the Installer controller allows any remote attack

历史摘要 · 未重新核验 · GitHub Advisory

FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

CVE-2026-27892

## Summary **Fectura Scripts** is an open-source ERP application, a **sensitive information disclosure vulnerability**

历史摘要 · 未重新核验 · GitHub Advisory

Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_data.php) includes hidden profile field...

CVE-2026-41659

Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (m

历史摘要 · 未重新核验 · NVD

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

CVE-2026-42880

### Summary There is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an at

历史摘要 · 未重新核验 · GitHub Advisory

Vercel: Non-interactive mode includes CLI arguments in suggested command output

CVE-2026-44479

# Summary When the Vercel CLI runs in non-interactive mode (`--non-interactive` or auto-detected AI agent), commands th

历史摘要 · 未重新核验 · GitHub Advisory

Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening

## Summary Eight independently-filed bug fixes in the v7.1.3 → v7.5.0 release window collectively close a set of multi-

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. This affects an unknown function of the file /cdemos/echs/api/v2/ of the component Response He...

CVE-2026-8033

A vulnerability has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. This affects an unknown function of t

历史摘要 · 未重新核验 · NVD