Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage...

CVE-2026-56212

Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization secur

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin...

CVE-2026-56080

Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin enables the policy and

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: Denial of Service via deep operator chains

An authenticated user could crash a SurrealDB server with a single query containing a long chain of operators. Such a q

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals

A record user could read field values hidden from them by field-level SELECT permissions by reaching the records through

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field

A field can be hidden from a user with a field-level SELECT permission (`DEFINE FIELD code ON secret PERMISSIONS FOR sel

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch

SurrealDB fetches the JWKS document for a JWT or record access method using a bare `reqwest` client that follows HTTP re

历史摘要 · 未重新核验 · GitHub Advisory

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

### Summary `NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_n

历史摘要 · 未重新核验 · GitHub Advisory

Cloudflare Quiche: Use-after-free in connection ID iterator FFI functions

CVE-2026-11941

### Impact Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functio

历史摘要 · 未重新核验 · GitHub Advisory

Zeep: Server-Side Request Forgery (SSRF)

## Summary When parsing a WSDL or XSD document, python-zeep follows transitive references — xsd:import, xsd:include, ws

历史摘要 · 未重新核验 · GitHub Advisory

Anki: User scripts in iframes have access to the internal Anki API

## Summary Anki's webview-based pages communicate with the Rust backend using an internal localhost API. Anki implement

历史摘要 · 未重新核验 · GitHub Advisory

ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer

## Summary ChatterBot's `UbuntuCorpusTrainer.extract()` uses a predictable, home-rooted output directory (`~/ubuntu_dat

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data

### Summary `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups

### Summary `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions

## Summary `network-ai`'s `ApprovalInbox` (`lib/approval-inbox.ts`) is a shipped, exported, documented feature — *"a we

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

### Summary `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment c

历史摘要 · 未重新核验 · GitHub Advisory

MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested

PathFilter's deny-list glob patterns are anchored, so `.git`, `.obsidian`, and `node_modules` were only blocked at the v

历史摘要 · 未重新核验 · GitHub Advisory

symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses

CVE-2026-55877

### Description The `ux_icon()` Twig function is marked `is_safe=['html']`, so Twig never escapes its output. `Icon::to

历史摘要 · 未重新核验 · GitHub Advisory

OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types

CVE-2026-55776

On OpenBao 2.5.4 and 2.5.2(and likely earlier versions also), an authenticated caller with write access to `transit/keys

历史摘要 · 未重新核验 · GitHub Advisory

OpenBao: LDAPi ldaputil (wrong escape func)

CVE-2026-55770

## 1. Description ### Component `sdk/helper/ldaputil/client.go` — the shared LDAP utility library used by both the LDA

历史摘要 · 未重新核验 · GitHub Advisory

Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code...

CVE-2026-50519

Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized at

历史摘要 · 未重新核验 · GitHub Advisory