共收录 1926 条相关情报。
← 返回所有主题CVE-2026-52799
Gogs is an open source self-hosted Git service. Prior to 0.14.3, GET /attachments/:uuid returns the raw attachment file
CVE-2026-55583
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was vulnerable to a cro
CVE-2026-27708
FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, the Servicecustom
CVE-2026-55611
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti
CVE-2026-55482
### Impact The `BulkAssetsController::update()` method accepts `company_id` directly from user input without calling `Co
CVE-2026-47388
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP token holder with kno
CVE-2025-64105
FOSSBilling is a billing and client management system that automates invoicing, payments, and communication for online s
CVE-2026-54015
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open
CVE-2026-54010
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open
CVE-2026-54009
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST
CVE-2026-55255
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, an Insecure Direct Object
CVE-2026-45732
n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, the OAuth1 and OAuth2 credent
CVE-2026-33760
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monito
CVE-2026-52799
## Summary In Gogs 0.14.1, `GET /attachments/:uuid` returns the raw attachment file **without verifying whether the req
CVE-2026-48067
Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until
CVE-2026-6062
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel o
CVE-2026-56424
MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong ent
CVE-2026-56422
Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (i
CVE-2026-56385
Craft CMS versions >= 5.0.0-RC1, = 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpo
CVE-2026-56229
Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that