OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in...
CVE-2026-114661
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any
#severity:critical
共收录 1449 条相关情报。
← 返回所有主题Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
CVE-2026-112393
``` ============================================================================ Heap buffer overflow in _tiffWriteProc
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
CVE-2026-112900
### Summary `PIL.EpsImagePlugin.Ghostscript()` builds the Ghostscript command line using the input file path (`fp.name`)
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
CVE-2026-114125
**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affect
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the...
CVE-2026-113744
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewa
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server...
CVE-2026-114119
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that...
CVE-2026-114108
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated a
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from...
CVE-2026-114087
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.examp
vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to...
CVE-2026-114053
vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProces
Pillow: Heap buffer overflow in ImagingJpegDecode
CVE-2026-112403
## Summary `JpegImageFile.draft()` — which `Image.thumbnail()` calls automatically — requests 1/2, 1/4 or 1/8 scaled JP
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.
certifi bundles emSign root CAs with compromised intermediate CA keys
Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eig
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose...
CVE-2026-77933
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the...
CVE-2026-77936
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the ...
CVE-2026-77932
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agen
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any...
CVE-2026-75128
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name with
piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat...
CVE-2026-109442
piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
CVE-2026-111057
### Summary A missing comma in `mercury_app/block_handler.py`'s `BLOCKED_PATTERNS` list causes the blocklist to fail to
Mercury: Unauthenticated Remote Code Execution via /api/kernels
CVE-2026-111058
Mercury runs a JupyterLab server with **anonymous access by default** (`mercury_app/__main__.py` sets `--IdentityProvide
Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the...
CVE-2026-102503
Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress s