A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element...
CVE-2026-108683
A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function
#severity:low
共收录 1562 条相关情报。
← 返回所有主题A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the...
CVE-2026-108682
A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /
Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to...
CVE-2026-108852
Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links
thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the...
CVE-2026-108839
thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs
UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows...
CVE-2026-108856
UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppK
A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is...
CVE-2026-108521
A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemot
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
## Summary Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not
Contao: Cross-site request forgery in custom backend actions
CVE-2026-107848
`RequestTokenListener` is the only generic `REQUEST_TOKEN` validator in Contao and it only runs on POST. On the GET side
An authenticated Ops Manager user with a read-only project role can retrieve a daily host...
CVE-2026-87108
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated w
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group...
CVE-2026-107890
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation re
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission...
CVE-2026-107885
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cups
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add...
CVE-2026-107886
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain...
CVE-2026-87980
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cl
A race condition and thread-safety vulnerability exists in the web management daemon of Brocade...
CVE-2026-94584
A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions befor
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to...
CVE-2026-107449
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enha
Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later...
CVE-2026-107448
Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) passes a
A race condition vulnerability exists in the request processing logic of the REST management...
CVE-2026-94583
A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric
Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may...
CVE-2026-87726
Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with
Docling: Configured HTTP headers sent to every remote image host named by a document
CVE-2026-105742
### Summary `HTMLBackendOptions.headers` is documented for passing authentication headers (API keys, bearer tokens) whe
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError
CVE-2026-106449
### Summary When `LZ4BlockInputStream` is configured with `stopOnEmptyBlock = false` (the mode for reading concatenated