In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probes. Specifically, ...

CVE-2026-3514

In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of UR

历史摘要 · 未重新核验 · NVD

The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in...

CVE-2026-9048

The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 7.0.0 - 7.0.14, v

历史摘要 · 未重新核验 · GitHub Advisory

The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 7.0.0 - 7.0.14, via the 'slider.get.full' AJAX Action. This makes it possi...

CVE-2026-9048

The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 7.0.0 - 7.0.14, v

历史摘要 · 未重新核验 · NVD

In multiple locations, there is a possible background activity launch due to a missing permission check. This could lead to local escalation of privilege with no additional exec...

CVE-2025-32348

In multiple locations, there is a possible background activity launch due to a missing permission check. This could lead

历史摘要 · 未重新核验 · NVD

Capsule is a multi-tenancy and policy-based framework for Kubernetes. The Capsule Controller runs with cluster-admin privileges. Although the TenantResource RawItems processing ...

CVE-2026-22872

Capsule is a multi-tenancy and policy-based framework for Kubernetes. The Capsule Controller runs with cluster-admin pri

历史摘要 · 未重新核验 · NVD

Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authoriz...

CVE-2026-45426

Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued f

来源摘录 · NVD

A vulnerability was determined in AstrBotDevs AstrBot 4.23.6. Affected by this issue is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py. This...

CVE-2026-10211

A vulnerability was determined in AstrBotDevs AstrBot 4.23.6. Affected by this issue is the function _normalize_rw_path

历史摘要 · 未重新核验 · NVD

PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation

CVE-2026-47407

## Summary The Platform server exposes resources under `/api/v1/workspaces/{workspace_id}/...` and protects them with a

历史摘要 · 未重新核验 · GitHub Advisory

Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders

CVE-2026-47231

## Summary `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` o

历史摘要 · 未重新核验 · GitHub Advisory

Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders

CVE-2026-47230

## Summary `modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the cross-folder m

历史摘要 · 未重新核验 · GitHub Advisory

Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`

CVE-2026-47227

## Summary `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) correspon

历史摘要 · 未重新核验 · GitHub Advisory

In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin

CVE-2026-49376

In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin

历史摘要 · 未重新核验 · GitHub Advisory

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups...

CVE-2026-49369

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages

历史摘要 · 未重新核验 · GitHub Advisory

In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin

CVE-2026-49376

In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin

历史摘要 · 未重新核验 · NVD

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages

CVE-2026-49369

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages

历史摘要 · 未重新核验 · NVD

CAPM3 vulnerable to Cross-Namespace resource access

## Summary CAPM3 is Metal3's Cluster API (CAPI) provider for baremetal provisioning in Kubernetes. Multiple cross-names

历史摘要 · 未重新核验 · GitHub Advisory

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh at...

CVE-2026-48501

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization h

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped clients to execute privileged commands. Attackers with operator...

CVE-2026-35674

OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped client

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows reuse of already-open blocked tabs. Attackers with access t...

CVE-2026-35673

OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows re

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands that allows authenticated senders to skip DM-only and allowFrom policy checks. Attackers...

CVE-2026-34507

OpenClaw before 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands that allows authenticated sende

历史摘要 · 未重新核验 · NVD