CVE-2026-15499 AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/crontools.py of the component Scheduled Task Handler. Performing a manipulation of the argument payload"note" results in improper authorization...

CVE-2026-15499

AstrBotDevs AstrBot (versions up to 4.25.2) contains a vulnerability in the function FutureTaskTool.call (astrbot/core/tools/cron_tools.py). Manipulating payload["note"] leads to improper authorization, enabling remote exploitation. Public exploit availability is reported. No remediation details ...

EUVD-2026-43221

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/crontools.py of the component Scheduled Task Handler. Performing a manipulation of the argument payload"note" results in improper authorization...

PT-2026-57544

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/cron tools.py of the component Scheduled Task Handler. Performing a manipulation of the argument payload"note" results in improper authorization...

CVE-2026-54068

creationtimestamp| type| source ---|---|--- 2026-07-10 20:35:17+00:00| published-proof-of-concept| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gcm7-57gf-953c 2026-07-11 04:41:43+00:00| seen| https://gist.github.com/alon710/5b22d6c437eabc82b89ba6fa8ccee27d...

MINI-FPPM-XG8Q-2MP8

Bulletin has no description...

GHSA-HVR9-72V2-FFF3 SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

Summary SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chrome/Chromium extension --...

MINI-P84J-CRMP-58V2

Bulletin has no description...

MINI-Q2WR-XXRV-CC8V

Bulletin has no description...

MINI-RXWR-3MHM-5J4V

Bulletin has no description...

MINI-VQ7V-5VRH-6CC4

Bulletin has no description...

MINI-R56M-PCXC-839V

Bulletin has no description...

SUSE-SU-2026:2837-1 Security update for libexif

This update for libexif fixes the following issues - CVE-2026-40385: Fixed information disclosure and crashes via integer overflow in Nikon MakerNote handling bsc1262000 - CVE-2026-40386: Fixed denial of service and information disclosure via integer underflow in MakerNote decoding bsc1262001 -...

PT-2026-57327

OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update widget a...

MINI-9MWH-38VC-48HG

Bulletin has no description...

MINI-F434-CPCQ-3WRM

Bulletin has no description...

MINI-95XW-MM8W-544Q

Bulletin has no description...

MINI-HMRC-834R-GR6X

Bulletin has no description...

CVE-2026-50554

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:10+00:00| published-proof-of-concept| https://github.com/enchant97/note-mark/security/advisories/GHSA-588f-fvcv-xhvf...

CVE-2026-58144

creationtimestamp| type| source ---|---|--- 2026-07-09 13:45:12+00:00| seen| https://gist.github.com/sermikr0/75686815e441c07462cfdea2fed5d305 2026-07-10 00:03:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqatvsmcv62t 2026-07-10 18:39:34+00:00| seen|...