Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

CVE-2026-54022

### Summary The `ydoc:document:join` Socket.IO handler checks note ownership only when the `document_id` starts with `n

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

CVE-2026-54021

## Summary Several direct, index-addressed Ollama proxy routes accept a caller-supplied `url_idx` path parameter and us

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Token scope bypass on web archive download endpoint

CVE-2026-20706

## Summary PR #37698 added checkDownloadTokenScope to /raw/*, /media/*, and attachment download web endpoints. The /arc

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo

CVE-2026-26231

## Summary Any authenticated low-privilege user with read access to a repository can push arbitrary commits directly to

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication

CVE-2026-28699

### Summary Gitea fails to enforce OAuth2 access token scopes when the token is submitted via HTTP Basic authentication

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens

CVE-2026-28744

### Summary Gitea v1.26.1 enforces repository-scoped access-token permissions on repository operations. In the Git Smart

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Credential Exfiltration via Permission Bypass

CVE-2026-54307

## Impact A member-level user with editor access to a shared workflow could reference credentials they do not own via sp

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Public API Execution Retry Authorization Bypass

## Impact The Public API endpoint for retrying executions authorized access using `workflow:read` rather than `workflow:

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat...

CVE-2026-53854

OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication t

历史摘要 · 未重新核验 · GitHub Advisory

Daytona: Public sandbox previews remain accessible for up to one hour after being made private

CVE-2026-54321

### Summary Sandbox previews that were switched from public to private could remain reachable without authentication for

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries through conversation metadata rather th...

CVE-2026-53860

OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters. Attacke...

CVE-2026-53855

OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows senders to inherit wildcard ownerAllowFrom sta...

CVE-2026-53854

OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication t

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowed arguments for allowlisted executables ...

CVE-2026-53853

OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to

历史摘要 · 未重新核验 · NVD

The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 This is due to the get_submission_content AJAX endpoint lack...

CVE-2026-5149

The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 Thi

历史摘要 · 未重新核验 · NVD

Nest: Middleware Bypass on Fastify via Trailing Slash

CVE-2026-54281

### Impact An authentication bypass vulnerability exists in `@nestjs/platform-fastify` (confirmed on version `11.1.24`,

历史摘要 · 未重新核验 · GitHub Advisory

Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in the check if remote accounts consented to be featured in ...

CVE-2026-47777

Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in

历史摘要 · 未重新核验 · NVD

WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles...

CVE-2016-20075

WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users

历史摘要 · 未重新核验 · NVD

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket communication used by the SafeControlle...

CVE-2026-34023

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.5.6 contains a configuration enforcement bypass vulnerability in Feishu...

CVE-2026-53835

OpenClaw before 2026.5.6 contains a configuration enforcement bypass vulnerability in Feishu dynamic-agent bindings that

历史摘要 · 未重新核验 · GitHub Advisory