The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's publi...

CVE-2026-104189

The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file

来源摘录 · NVD

3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share

CVE-2026-104189

The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file

历史摘要 · 未重新核验 · OSV.dev

Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with...

CVE-2026-117472

Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a h

历史摘要 · 未重新核验 · NVD

A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Int...

CVE-2026-116623

A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of t

来源摘录 · NVD

Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py...

CVE-2026-116575

Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript

历史摘要 · 未重新核验 · NVD

Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul...

CVE-2026-110720

Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding r

历史摘要 · 未重新核验 · NVD

Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `Terr...

CVE-2026-102649

Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhoo

来源摘录 · NVD

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations,...

CVE-2026-116140

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executa

历史摘要 · 未重新核验 · GitHub Advisory

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linkin...

CVE-2026-116136

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows s

来源摘录 · NVD

A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAu...

CVE-2026-115972

A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function

来源摘录 · NVD

BookStack before 26.09.2 contains an incorrect authorization vulnerability in...

CVE-2026-116020

BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authentic

历史摘要 · 未重新核验 · GitHub Advisory

LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

CVE-2026-115883

### Summary The Postgres and SQLite stores save a namespace as its labels joined with `.`, so `("tenant", "bob")` and `

历史摘要 · 未重新核验 · GitHub Advisory

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an...

CVE-2026-75525

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions

来源摘录 · NVD

Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

### Impact Three issues allowed actions protected by the `#[Authorize]` attribute to run against records the current us

历史摘要 · 未重新核验 · GitHub Advisory

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

## Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validatin

历史摘要 · 未重新核验 · GitHub Advisory

obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

CVE-2026-115478

### Summary `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate a memory

历史摘要 · 未重新核验 · GitHub Advisory

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_ent...

CVE-2026-115478

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `crea

来源摘录 · NVD

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configu...

CVE-2026-115477

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a

来源摘录 · NVD

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-d...

CVE-2026-57142

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a

来源摘录 · NVD

PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write...

CVE-2026-57117

PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgen

来源摘录 · NVD