motionEye's World-Readable Configuration File Exposes Admin Password Hash

CVE-2026-32315

# Security Advisory: World-Readable Configuration File Exposes Admin Password Hash in motionEye ## Summary motionEye v

历史摘要 · 未重新核验 · GitHub Advisory

motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint

CVE-2026-31978

### Summary motionEye v0.43.1 (latest stable) is vulnerable to path traversal in the picture and movie API endpoints, l

历史摘要 · 未重新核验 · GitHub Advisory

OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature

CVE-2026-21887

### Summary The OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axi

历史摘要 · 未重新核验 · GitHub Advisory

OpenCTI May Bypass Introspection Restriction

CVE-2024-37155

### Summary The regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace

历史摘要 · 未重新核验 · GitHub Advisory

Anki's local HTTP server does not sufficiently validate requests

## Summary Anki launches a local HTTP server to serve media files and web pages for parts of its interface. The server

历史摘要 · 未重新核验 · GitHub Advisory

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

### Summary `NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_n

历史摘要 · 未重新核验 · GitHub Advisory

LangSmith SDK TracingMiddleware: Arbitrary server-side file read

# Summary An attacker who can send an HTTP request to a server running the LangSmith SDK's `TracingMiddleware` can caus

历史摘要 · 未重新核验 · GitHub Advisory

Zeep: Server-Side Request Forgery (SSRF)

## Summary When parsing a WSDL or XSD document, python-zeep follows transitive references — xsd:import, xsd:include, ws

历史摘要 · 未重新核验 · GitHub Advisory

Anki: User scripts in iframes have access to the internal Anki API

## Summary Anki's webview-based pages communicate with the Rust backend using an internal localhost API. Anki implement

历史摘要 · 未重新核验 · GitHub Advisory

ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer

## Summary ChatterBot's `UbuntuCorpusTrainer.extract()` uses a predictable, home-rooted output directory (`~/ubuntu_dat

历史摘要 · 未重新核验 · GitHub Advisory

EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id

EverOS versions 1.0.0 and earlier are vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint. Th

历史摘要 · 未重新核验 · GitHub Advisory

stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)

### Summary On a multi-tenant stigmem node, a caller holding a `write` credential for **one** tenant can run a decay swe

历史摘要 · 未重新核验 · GitHub Advisory

stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)

### Summary On a multi-tenant stigmem node, a tenant administrator could list, read, and **admit or reject** quarantined

历史摘要 · 未重新核验 · GitHub Advisory

stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)

### Summary On a multi-tenant stigmem node, RTBF (right-to-be-forgotten) tombstones were mis-scoped two ways. (1) `issue

历史摘要 · 未重新核验 · GitHub Advisory

MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error

### Impact If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. If the Unpacke

历史摘要 · 未重新核验 · GitHub Advisory

Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

CVE-2026-55447

### Summary All components based on `BaseFileComponent` are vulnerable to the following vulnerability: 1. Docling (`Docl

历史摘要 · 未重新核验 · GitHub Advisory

Langflow: Unauthenticated DoS through multipart form boundary file upload

CVE-2026-55446

### Summary An attacker can send a `/api/v1/files/upload/` request without any authentication token/cookies and abuse a

历史摘要 · 未重新核验 · GitHub Advisory

Langflow: Logout button does not clear session

CVE-2026-55423

### Summary The logout button does not clear the session. The previous user stays logged in unless another user explicit

历史摘要 · 未重新核验 · GitHub Advisory

Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

CVE-2026-55255

## Summary Insecure Direct Object Reference (IDOR) vulnerability in `/api/v1/responses` endpoint allows an authenticate

历史摘要 · 未重新核验 · GitHub Advisory

py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()

CVE-2026-55206

### Summary PackInfo._read() uses an O(n^2) cumulative sum pattern where numstreams is read directly from the archive

历史摘要 · 未重新核验 · GitHub Advisory