LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
CVE-2026-108372
## Summary `loopx serve-status` sends `Access-Control-Allow-Origin: *` on **every** response, including its unauthentic
#pip
共收录 834 条相关情报。
← 返回所有主题LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
CVE-2026-105192
### Summary LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiproce
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
CVE-2026-96620
The Claude Agent SDK for Python passed the `resume` option to the Claude CLI without validation, allowing a value beginn
ClickMigrate has Path Traversal in "revision -m" argument
CVE-2026-68549
### Impact A path traversal vulnerability in the `revision` command allowed a crafted migration name supplied via the `-
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
CVE-2026-102682
Pipecat’s built-in development runner exposes endpoints that create bot sessions and, for the Daily transport, paid Dail
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
CVE-2026-102832
## Description A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the
tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
CVE-2026-104266
### Impact An M4A file containing a sub-atom with a size of zero in the `----` atom makes the parser enter an infinite l
copyparty FTP: upload outside defined volumes (limited path traversal)
CVE-2026-104102
The FTP and FTPS server -- if enabled -- would allow uploading to any folder that the copyparty process had permission t
unstructured: Stored XSS via unescaped HTML generation
CVE-2026-104250
### Summary When `unstructured` parses an untrusted document and outputs the result as HTML, malicious markup contained
BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction
CVE-2026-14966
BBOT's `unarchive` module rejects archives containing symlink entries before extraction, but for zip and 7z archives it
Apprise forwards configured auth headers across cross-origin HTTP redirects
CVE-2026-59180
# Summary Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders (`apprise/attachment/http.
Shiny for Python has path traversal in bookmark restore
CVE-2026-108258
### Impact Shiny for Python's bookmark-restore path accepted a client-supplied `_state_id_` query-string value and join
pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents
CVE-2026-107841
### Impact `pacioli-guard`'s document-layer consent gate requires a human-minted, single-use, document-bound and **act-
pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
## Summary `Api.getUserData` (legacy) and `Api.get_userdata` are declared with `@permission(Perms.ANY)` and are reachab
pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
## Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
An admin who revokes a user's privileges through the REST API does not actually revoke them, because the session carryin
pyLoad: Api.set_user_permission never invalidates the target's session
### Summary An admin who revokes or downgrades a non-admin user's permissions through pyLoad's own documented `/api/` RP
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
## Summary pyLoad ships the WindowsPhoneNotify addon, whose `send()` method opens an HTTP connection to a host taken di
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
### Summary `UnTar._safe_extractall` — the hardening added for GHSA-mvwx-582f-56r7 — validates member **names** and sym
pyLoad has an authentication bypass in API key validation (check_apikey cache)
## Summary The API-key cache in `check_apikey()` allows an attacker to authenticate with a **forged API key** as long a