TinyAGI Message API Endpoint index.ts processMessage authorization
CVE-2026-19010
A security vulnerability has been detected in TinyAGI 0.0.20. Impacted is the function processMessage of the file packag
#cwe-862
共收录 4228 条相关情报。
← 返回所有主题The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9....
CVE-2026-15991
The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation
Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before route mi...
CVE-2026-71316
Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries
Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GE...
CVE-2026-70618
Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user
Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by s...
CVE-2026-70617
Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attac
Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in J...
CVE-2026-70445
Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permissio
A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credent...
CVE-2026-70438
A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overal
Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper permission check (1.4.1) when providi...
CVE-2026-70436
Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or p
A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-...
CVE-2026-70435
A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permissio
Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenk...
CVE-2026-70433
Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission t
Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows...
CVE-2026-70619
Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users
Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
CVE-2026-70494
## Summary A user granted write access to a shared chat folder could permanently delete chats and messages belonging to
Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
CVE-2026-70487
## Summary Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model
Open WebUI: Users denied the image-generation permission can still generate images via chat completions
CVE-2026-70484
## Summary An authenticated user whose `features.image_generation` permission has been revoked can still make the server
Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
CVE-2026-70483
## Summary `DELETE /api/v1/chats/{id}` cancelled a chat's in-flight tasks before it checked whether the caller was allow
Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
CVE-2026-70481
## Summary On standard channels, the message update and delete handlers accepted any caller holding write access on the
Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials
## Summary The `/api/v1/text-to-speech/generate` endpoint is whitelisted (requires no authentication) and accepts any `
Flowise: Missing Authorization on Execution Update Endpoint
CVE-2026-70475
# Flowise Security Audit Report **Date**: 2026-03-17 **Researcher**: Dimpal Jadhav (jadhavdimpy@gmail.com) **GitHub**: h
Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to...
CVE-2026-66326
Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to...
CVE-2026-66311
Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.