NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise another workspace's integration through the testConnection ...

CVE-2026-47381

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise an

历史摘要 · 未重新核验 · NVD

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the ...

CVE-2026-52845

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the

历史摘要 · 未重新核验 · NVD

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a ...

CVE-2026-54308

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeT

历史摘要 · 未重新核验 · NVD

n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification. Attackers w...

CVE-2026-56357

n8n 是一个工作流自动化平台，其 GitHub Webhook Trigger 节点存在 Webhook 伪造漏洞。在 n8n 1.123.15 之前版本和 2.5.0 之前版本中，该节点未实现对 GitHub Webhook 请求的 H

历史摘要 · 未重新核验 · NVD

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, This vulnerability is fixed in 1.84.0.

CVE-2026-49468

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, This vulnerabili

历史摘要 · 未重新核验 · NVD

Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers

CVE-2026-25119

## Summary When `ENABLE_REVERSE_PROXY_AUTHENTICATION` is enabled, Gogs accepts the configured authentication header (de

历史摘要 · 未重新核验 · GitHub Advisory

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plu...

CVE-2026-49231

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upst

历史摘要 · 未重新核验 · NVD

Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication capitalising on certain configurations of jwt-auth plugin. T...

CVE-2026-39999

Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication cap

历史摘要 · 未重新核验 · NVD

OpenClaw: Discord allowFrom could bind to mutable display names

CVE-2026-53849

### Summary Discord allowFrom could bind to mutable display names. In affected versions, a Discord account able to chan

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Zalo allowFrom could bind to mutable display names

CVE-2026-53857

### Summary Zalo allowFrom could bind to mutable display names. In affected versions, a Zalo friend or contact with mut

历史摘要 · 未重新核验 · GitHub Advisory

The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user...

CVE-2026-56020

The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL clie

历史摘要 · 未重新核验 · GitHub Advisory

@acastellon/auth: Authentication bypass via spoofable headers in validateToken()

@acastellon/auth v2.2.0 appears to allow an unauthenticated authentication bypass in validateToken() through spoofable a

历史摘要 · 未重新核验 · GitHub Advisory

The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote ...

CVE-2026-56020

The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL clie

历史摘要 · 未重新核验 · NVD

Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate...

CVE-2026-50141

Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's

历史摘要 · 未重新核验 · NVD

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header...

CVE-2026-55202

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection,

历史摘要 · 未重新核验 · GitHub Advisory

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats p...

CVE-2026-55202

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection,

来源摘录 · NVD

LiteLLM: Authentication Bypass via Host Header Injection

CVE-2026-49468

### Impact A Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated acce

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with...

CVE-2026-53857

OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata c

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom...

CVE-2026-53849

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates

历史摘要 · 未重新核验 · GitHub Advisory

Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

CVE-2026-52845

### Summary `forward_auth copy_headers` deletes the exact client-supplied identity header before copying the trusted va

历史摘要 · 未重新核验 · GitHub Advisory