#cwe-829

共收录 170 条相关情报。

漏洞预警2026-07-17 发布INFO

OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control...

CVE-2026-62222

OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plu

历史摘要 · 未重新核验 · NVD

#cve #cwe-829

安全公告2026-07-17 发布INFO

OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode

CVE-2026-62222

OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plu

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-829

漏洞预警2026-07-16 发布INFO

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tr...

CVE-2026-59867

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching re

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-829 #cwe-918

漏洞预警2026-07-16 发布INFO

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency...

CVE-2026-59865

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota info` read x-ms-kiota-info.languagesInform

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-829

漏洞预警2026-07-16 发布INFO

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_te...

CVE-2026-59864

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota plugin add` and `kiota plugin generate` (w

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-829

安全公告2026-07-16 发布INFO

Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

CVE-2026-59867

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching re

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-829 #cwe-918

安全公告2026-07-16 发布INFO

Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

CVE-2026-59864

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota plugin add` and `kiota plugin generate` (w

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-829

安全公告2026-07-16 发布INFO

Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`

CVE-2026-59865

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota info` read x-ms-kiota-info.languagesInform

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-829 #cwe-94

安全公告2026-07-15 发布INFO

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code...

CVE-2026-40501

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in S

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-829 #severity:high

漏洞预警2026-07-15 发布INFO

FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull request code in .github...

CVE-2026-50562

FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, ar

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-494 #cwe-829

漏洞预警2026-07-15 发布INFO

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in SearchService that allows remote attackers to execute arbi...

CVE-2026-40501

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in S

历史摘要 · 未重新核验 · NVD

#cve #cwe-829

安全公告2026-07-15 发布INFO

Cherry Studio RCE via SearchService nodeIntegration Misconfiguration

CVE-2026-40501

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in S

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-829

安全公告2026-07-14 发布INFO

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper...

CVE-2026-24226

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-829 #severity:medium

漏洞预警2026-07-14 发布INFO

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulnerability might lead t...

CVE-2026-24226

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation

历史摘要 · 未重新核验 · NVD

#cve #cwe-829

漏洞预警2026-07-14 发布INFO

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-57102

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-829

安全公告2026-07-13 发布INFO

A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the...

CVE-2026-15519

A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file system_prompt.jinj

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-829 #severity:low

漏洞预警2026-07-13 发布INFO

A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file system_prompt.jinja of the component PyPI Handler. Performing a manipulatio...

CVE-2026-15519

A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file system_prompt.jinj

历史摘要 · 未重新核验 · NVD

#cve #cwe-829

漏洞预警2026-07-09 发布INFO

GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution bec...

CVE-2026-59831

GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace

历史摘要 · 未重新核验 · NVD

#cve #cwe-829

漏洞预警2026-07-01 发布INFO

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate ...

CVE-2026-50195

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-829

漏洞预警2026-06-30 发布INFO

LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious mode...

CVE-2026-58116

LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-829