共收录 2248 条相关情报。
← 返回所有主题CVE-2026-50559
Quarkus是一个用于构建云原生应用的Java框架。在版本3.37.0、3.36.3、3.33.2.1、3.33.3、3.27.4.1、3.27.5和3.20.6.2之前，Quarkus存在一个HTTP路径授权绕过漏洞。攻击者可以利用UR
CVE-2026-48794
CVE-2026-48794 是 Authelia 开源身份认证和授权服务器中的一个安全漏洞，影响版本 4.36.0 至 4.39.19。该漏洞源于在特定边缘情况下对域名的规范化处理缺失，导致访问控制规则可能被跳过。具体利用条件极为苛刻，包
CVE-2026-48772
ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL
CVE-2026-48089
DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instanc
CVE-2026-49288
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Con
CVE-2026-47339
Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under defaul
CVE-2026-56074
PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequ
CVE-2026-56075
PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode appro
CVE-2026-56075
PraisonAI 是一个基于 AI 的自动化平台。在 4.5.128 之前的版本中，UI 模块硬编码了 approval_mode 为 auto，覆盖了通过环境变量 PRAISON_APPROVAL_MODE 设置的管理员配置。这导致经过
CVE-2026-56074
PraisonAI 是一个人工智能辅助工具平台，其 1.5.128 版本之前存在一个严重的安全逻辑缺陷：工具批准决策仅根据工具名称缓存，而不检查调用参数。这意味着用户第一次批准某个工具（例如执行'ls'命令）后，后续任何与该工具同名的调用（
CVE-2026-53854
### Summary Internal/webchat command auth could inherit ownerAllowFrom wildcard state. In affected versions, a sender o
CVE-2026-53853
### Summary OpenClaw's exec allowlist supported optional `argPattern` entries to restrict the arguments accepted for an
CVE-2026-53860
### Summary BlueBubbles sender policy could match mutable conversation identifiers. In affected versions, a participant
CVE-2026-53855
### Summary Shell positional parameters could weaken strict inline-eval checks. In affected versions, a command request
CVE-2026-10741
Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configur
CVE-2026-55518
## Summary A critical missing authorization flaw exists in Avo's association attach workflow. The UI and `GET /resource
CVE-2026-55636
### Summary Capsule v0.13.2 webhook rules contain `namespace/finalize` (singular) instead of `namespaces/finalize` (plur
CVE-2026-24791
## Summary Many authenticated self routes under `/api/v1/user/...` do not enforce the `public-only` token restriction.
CVE-2026-22555
## Summary The API endpoint `POST /api/v1/repos/{owner}/{repo}/forks` only checks `IsOrgMember()` when a user forks a r
CVE-2026-54324
### Summary A cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user