Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated threat actor to request a JWT for any user in...

CVE-2026-47202

Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unau

历史摘要 · 未重新核验 · NVD

nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint (/auth/v1/introspect_access_token) acc...

CVE-2026-41164

nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token intr

历史摘要 · 未重新核验 · NVD

@hulumi/drift: Orphan reconciler accepted externally supplied execute plans

Impact: @hulumi/drift versions before 1.3.2 could accept externally supplied execute plans without sufficient provenance

历史摘要 · 未重新核验 · GitHub Advisory

Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss

CVE-2026-46654

### Impact - **Key**: `challenger/src/multi_field_challenger.rs` | `MultiField32Challenger::duplexing` | `transcript_ma

历史摘要 · 未重新核验 · GitHub Advisory

RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM

CVE-2026-45792

RTK (Rust Token Killer) improperly trusts project-local configuration files. In versions prior to 0.32.0, RTK automatica

历史摘要 · 未重新核验 · GitHub Advisory

Insufficient Verification of Data Authenticity vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component makes it possible to send messages to any...

CVE-2026-25602

Insufficient Verification of Data Authenticity vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona S

历史摘要 · 未重新核验 · NVD

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.6.34 through 0.6.51, the backend deseria...

CVE-2026-33233

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent

历史摘要 · 未重新核验 · NVD

Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation during installation or ...

CVE-2026-32323

Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may

历史摘要 · 未重新核验 · NVD

arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS

### Summary Three medium-severity issues in arnika affecting the UDP key-rotation protocol, PQC key file handling, and K

历史摘要 · 未重新核验 · GitHub Advisory

Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE

### Am I affected? Users are affected if all of the following are true: - The application uses `better-auth` at a vers

历史摘要 · 未重新核验 · GitHub Advisory

Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the NixOS module default), anyone who can reach /proto can reg...

CVE-2026-44592

Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the N

历史摘要 · 未重新核验 · NVD

Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any...

CVE-2026-44523

Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JW

历史摘要 · 未重新核验 · NVD

Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint ...

CVE-2026-44308

Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pp

历史摘要 · 未重新核验 · NVD

CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CC_STORE_URL directly from the Host request header at bootstrap, with no allowlist. The...

CVE-2026-45055

CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CC_STORE_URL directly from the

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.4.20 fails to properly preserve untrusted labels for isolated cron awareness events, allowing webhook-triggered cron agent output to be recorded as trusted ...

CVE-2026-44999

OpenClaw before 2026.4.20 fails to properly preserve untrusted labels for isolated cron awareness events, allowing webho

历史摘要 · 未重新核验 · NVD

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares in...

CVE-2026-42575

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifi

历史摘要 · 未重新核验 · NVD

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook h...

CVE-2026-41432

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to versio

历史摘要 · 未重新核验 · NVD

Roadiz is a polymorphic content management system based on a node system. Prior to versions 2.3.43, 2.5.45, 2.6.31, and 2.7.18, the roadiz/openid package generates an OIDC nonce...

CVE-2026-42206

Roadiz is a polymorphic content management system based on a node system. Prior to versions 2.3.43, 2.5.45, 2.6.31, and

历史摘要 · 未重新核验 · NVD

Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery

CVE-2026-44523

#### Summary No minimum length or entropy is enforced on the `JWT_SECRET` configuration value. The application accepts

历史摘要 · 未重新核验 · GitHub Advisory

Spring Cloud AWS missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications

CVE-2026-44308

### Impact Applications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support (@NotificationMessageMapping, @Notif

历史摘要 · 未重新核验 · GitHub Advisory