Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order
CVE-2026-45665
### Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in the Banner component due to an improper sanitiza
#npm
共收录 1041 条相关情报。
← 返回所有主题Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
CVE-2026-22706
### Summary of CVE-2026-22706 Vulnerability Details - CVE: CVE-2026-22706 - CVSS v3.1 Vector: `CVSS:4.0/AV:N/AC:H/AT:N/
Strapi Vulnerable to SQL Injection in Content Type Builder
CVE-2026-22599
### Summary of CVE-2026-22599 Vulnerability Details - CVE: CVE-2026-22599 - CVSS v3.1 Vector: `CVSS:4.0/AV:N/AC:L/AT:N/
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying
CVE-2025-64526
### Summary of CVE-2025-64526 Vulnerability Details - CVE: CVE-2025-64526 - CVSS v3.1 Vector: `CVSS:4.0/AV:N/AC:L/AT:N/
claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh
CVE-2026-45136
## Summary `tools/quota-statusline.sh` (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly in
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
CVE-2026-45134
## Description The LangSmith SDK's prompt pull methods (`pull_prompt` / `pull_prompt_commit` in Python, `pullPrompt` /
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
CVE-2026-44724
## Summary On Linux, `systeminformation` is vulnerable to command injection in `networkInterfaces()` when an **active N
OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover
CVE-2026-44720
### Overview A critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access
Astro: Server island encrypted parameters vulnerable to cross-component replay
CVE-2026-45028
### Impact Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of serve
SillyTavern has a SSRF vulnerability in the CORS proxy middleware
CVE-2026-44652
## Resolution SillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting). Since we ex
SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware
CVE-2026-44651
## Resolution Fixed in SillyTavern 1.18.0: a user-provided URL is no longer reflected in the HTTP response body. ## Ov
SillyTavern has a Path Traversal issue
CVE-2026-44650
## Summary `POST /api/extensions/delete` endpoint accepts `extensionName: "."` which bypasses `sanitize-filename` vali
SillyTavern has Authentication Bypass via SSO Header Injection
CVE-2026-44649
## Resolution SillyTavern 1.18.0 now includes a configuration option to limit which IP addresses can authorize using SS
SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover
CVE-2026-44648
### Summary Changing a user’s password does not invalidate existing sessions, allowing an attacker with a stolen cookie
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
CVE-2026-42074
### Summary The `dangerouslyDisableSandbox` parameter is exposed as part of the BashTool input schema, meaning the LLM (
OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS
CVE-2026-42073
# OAuth State Validation Bypass via `error` Parameter Causes Local Server DoS in MCP Auth Callback --- ## Description
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
CVE-2026-45091
In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret
protobuf.js: Code injection in pbjs static output from crafted schema names
CVE-2026-44295
## Summary `pbjs` static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names.
protobuf.js: Denial of service from crafted field names in generated code
CVE-2026-44294
## Summary protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain con
protobuf.js: Code injection through bytes field defaults in generated toObject code
CVE-2026-44293
## Summary protobufjs generated JavaScript for `toObject` conversion could include an unsafe expression derived from a