MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
CVE-2026-69148
### Summary The `_validate_source_run` and `_validate_source_model` functions in `mlflow/server/handlers.py` verify tha
#severity:high
共收录 5387 条相关情报。
← 返回所有主题9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint
CVE-2026-56677
### Summary A Server-Side Request Forgery (SSRF) vulnerability exists in the 9Router dashboard via the `/api/auth/oidc/
http4k: `DigestAuthProvider.verify` did not bind to request URI
CVE-2026-54148
### Impact An issue in `DigestAuthProvider.verify`: The `uri` parameter in the client's `Authorization: Digest …` resp
docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service
CVE-2026-53752
### Summary docx4j's `PropertyResolver` and several adjacent helpers recursively walk the OpenXML style inheritance chai
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
CVE-2026-53659
### Impact `ServerFilters.GZip` and `RequestFilters.GunZip` (and the underlying `Gzip` functions used to decompress req
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard
`_estimate_batch_cost` (`atomic_agents/agent.py`) looks up the per-model output price with `PRICING.get(model, {})`, ret
atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)
The HTTP MCP server-registry backend factory (`atomic_agents/mcp_registry/http.py`, `make_http_mcp_server_registry_backe
SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server...
CVE-2026-75482
SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths t
JimuReport contains an authentication bypass vulnerability in the report folder template listing...
CVE-2026-75479
JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows un
OpenViking debug vector scroll and count endpoints apply only account-level scoping without user...
CVE-2026-75480
OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls,
Evidently UI fails to properly validate the filename parameter in the dataset materialization...
CVE-2026-75111
Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthe
SkyPilot fails to validate that authenticated users are entitled to grant administrator roles...
CVE-2026-75481
SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service acco
Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download...
CVE-2026-71518
Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unaut
phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a...
CVE-2026-75105
phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issu
Crawlab fails to verify user ownership or administrative role on the password-change endpoint,...
CVE-2026-75103
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticate
Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in...
CVE-2026-75109
Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authe
An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service...
CVE-2026-68005
An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request he
A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad...
CVE-2026-70495
A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing
Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow...
CVE-2026-19589
Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system
Netty: Memory Exhaustion in SctpMessageCompletionHandler
CVE-2026-59902
### Summary SctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticate