#cwe-22

共收录 2809 条相关情报。

漏洞预警2026-07-13 发布INFO

A security vulnerability has been detected in alioshr memory-bank-mcp up to 0.2.1/3.1. This affects an unknown part of the file list-project-files-validation-factory.ts. Such ma...

CVE-2026-15524

A security vulnerability has been detected in alioshr memory-bank-mcp up to 0.2.1/3.1. This affects an unknown part of t

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-13 发布INFO

A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component r...

CVE-2026-15522

A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function v

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-13 发布INFO

A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the file build/server.cjs of the component update_node_from_file...

CVE-2026-15521

A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the fil

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-07-12 发布INFO

Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's ...

CVE-2026-56260

Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf end

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:high

漏洞预警2026-07-12 发布INFO

Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_path parameter accepts arbitrary files...

CVE-2026-56260

Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf end

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-07-12 发布INFO

Crawl4AI - Arbitrary File Write via output_path Parameter

CVE-2026-56261 · CVE-2026-56262 · CVE-2026-56263 · CVE-2026-56264 · CVE-2026-56265 · CVE-2026-56266 · CVE-2026-56260

Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf end

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

安全公告2026-07-11 发布INFO

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in...

CVE-2026-61445

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:critical

安全公告2026-07-11 发布INFO

PraisonAI before 4.6.78 fails to validate file path references in custom command templates,...

CVE-2026-60088

PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read f

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:medium

漏洞预警2026-07-11 发布CRITICAL

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in L...

CVE-2026-61445

PraisonAI 在 4.6.78 之前的版本中存在严重安全漏洞，位于 AICoder 组件中。该漏洞源于 LLM 工具调用时缺乏路径验证和命令清理，允许攻击者通过聊天界面注入恶意提示。攻击者可以利用此漏洞将任意文件写入文件系统的任意位置

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-11 发布INFO

PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include path tr...

CVE-2026-60088

PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read f

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-07-11 发布INFO

PraisonAI before 4.6.78 Arbitrary File Write and Command Execution

CVE-2026-61445

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

安全公告2026-07-11 发布INFO

PraisonAI before 4.6.78 Path Traversal via Custom Commands

CVE-2026-60088

PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read f

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

安全公告2026-07-11 发布INFO

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up...

CVE-2026-9282

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:high

漏洞预警2026-07-11 发布INFO

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible fo...

CVE-2026-9282

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-07-11 发布INFO

The UnderConstructionPage PRO plugin for WordPress is vulnerable to Arbitrary File Read in all...

CVE-2026-11426

The UnderConstructionPage PRO plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and inclu

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:medium

漏洞预警2026-07-11 发布MEDIUM

The UnderConstructionPage PRO plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.76. This is due to the plugin accepting arbitrary...

CVE-2026-11426

CVE-2026-11426 影响 WordPress 插件 UnderConstructionPage PRO 的所有版本（包括 5.76 及以下）。该漏洞源于插件在处理 template_thumbnail 参数时，未对用户提供的本地文

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-10 发布INFO

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked...

CVE-2026-55852

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Imp

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-10 发布INFO

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. This issue is fixed i...

CVE-2026-42219

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-10 发布INFO

Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Ch...

CVE-2026-41482

Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion wer

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-10 发布INFO

EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint because the per-message sender_id...

CVE-2026-58499

EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal in the POST /api/v1/memory

历史摘要 · 未重新核验 · NVD

#cve #cwe-22