Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.

CVE-2026-46728

Das U-Boot 2026.04之前版本中的FIT（扁平映像树）签名验证存在绕过漏洞，原因是哈希计算时未包含'hashed-nodes'字段。攻击者可利用此漏洞，通过构造特制的FIT映像，绕过签名验证机制，从而在目标系统上加载并执行未授

历史摘要 · 未重新核验 · NVD

RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http...

CVE-2026-42559

RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP se

历史摘要 · 未重新核验 · NVD

SillyTavern has Authentication Bypass via SSO Header Injection

CVE-2026-44649

## Resolution SillyTavern 1.18.0 now includes a configuration option to limit which IP addresses can authorize using SS

历史摘要 · 未重新核验 · GitHub Advisory

Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, Cleanuparr's g...

CVE-2026-44184

Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download c

历史摘要 · 未重新核验 · NVD

Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation

CVE-2026-27478

**Context:** A critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint (/api/1.

历史摘要 · 未重新核验 · GitHub Advisory

@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry

# Docker registry auth substring match forwards credentials to a different registry ## Repository `cdxgen/cdxgen` ##

历史摘要 · 未重新核验 · GitHub Advisory

locize is a localization platform that connects code and i18n setup. Prior to version 4.0.21, the locize client SDK registers a window.addEventListener("message", …) handler tha...

CVE-2026-41886

locize is a localization platform that connects code and i18n setup. Prior to version 4.0.21, the locize client SDK regi

历史摘要 · 未重新核验 · NVD

Origin Validation Error vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Accessing Functionality Not Properly Constrained by ACLs. Thi...

CVE-2026-6508

Origin Validation Error vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Acces

历史摘要 · 未重新核验 · NVD

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request...

CVE-2026-43870

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutra

历史摘要 · 未重新核验 · NVD

A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function...

CVE-2026-7643

A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of t

历史摘要 · 未重新核验 · GitHub Advisory

A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a manipulation can l...

CVE-2026-7643

CVE-2026-7643 影响 ChatGPTNextWeb NextChat 至 2.16.1 版本。漏洞位于 API 端点的 Next.js 文件中，由于不安全的跨域策略配置，攻击者可利用该漏洞发起远程攻击，导致与不可信域名之间的跨域

历史摘要 · 未重新核验 · NVD

A security vulnerability has been detected in alexta69 MeTube up to 2026.04.09. This affects the function on_prepare of the file app/main.py of the component CORS Policy. The ma...

CVE-2026-7581

A security vulnerability has been detected in alexta69 MeTube up to 2026.04.09. This affects the function on_prepare of

历史摘要 · 未重新核验 · NVD

AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs...

CVE-2026-7439

AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without

历史摘要 · 未重新核验 · GitHub Advisory

AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attacker...

CVE-2026-7439

AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without

历史摘要 · 未重新核验 · NVD

OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and ...

CVE-2026-22077

OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access res

历史摘要 · 未重新核验 · NVD

A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. ...

CVE-2009-4139

A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote a

来源摘录 · NVD