共收录 834 条相关情报。
← 返回所有主题CVE-2026-75597
### Summary The `/web/` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without an
CVE-2026-48484
## Description: The API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole
CVE-2026-107716
### Summary In `banks.registries.DirectoryPromptRegistry`, prompt file paths and the index file (`index.json`) do not re
CVE-2026-107717
## Summary Banks' `Prompt.chat_messages()` method parses every rendered output line as a potential `ChatMessage` JSON
CVE-2026-107394
### Impact Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part o
CVE-2026-107395
### Impact A legacy API to retrieve session details could be misused to retrieve metadata (such as title, description an
CVE-2026-107397
### Impact There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent ed
CVE-2026-107396
### Impact There is a Cross-Site-Scripting vulnerability in fields that allow entering custom URLs. ### Patches You sho
CVE-2026-61442
# Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass ## Summary `p
CVE-2026-61434
### Summary The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2m
CVE-2026-61445
### Summary The `AICoder` UI component exposes `write_to_file` and `execute_command` tools to the LLM with no path valid
CVE-2026-61427
## Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaul
CVE-2026-61440
# Platform members can rewrite shared labels and owner issue labels without owner/admin authorization ## Summary `prai
CVE-2026-60085
Summary SecurityPolicy in praisonaiagents/sandbox/config.py is a documented configuration data class with fields for all
CVE-2026-60091
## Summary PraisonAI's Async Jobs API enables its API-key middleware **only when `PRAISONAI_JOBS_API_KEY` is set**, so
CVE-2026-107286
> This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. ### Summary Applications that wrap a mo
CVE-2026-61439
### Summary Injection Defense is a purpose-built prompt injection defense layer. It scans LLM inputs through six detecti
CVE-2026-105742
### Summary `HTMLBackendOptions.headers` is documented for passing authentication headers (API keys, bearer tokens) whe
CVE-2026-105743
### Summary When remote fetching is enabled (`enable_remote_fetch=True`, together with `fetch_images=True` or HTML `ren
CVE-2026-105744
### Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine (`LatexBackendOptions