CVE-2026-85673 LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding

LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The checkssrfurl guard validates URLs once but requests.get follows redirects and re-resolves DNS without...

EUVD-2026-71129

LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The checkssrfurl guard validates URLs once but requests.get follows redirects and re-resolves DNS without...

CVE-2026-85671

QAnything 2.0.0 contains an authentication bypass in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints. Unauthenticated attackers can enumerate file identifiers and retrieve base64-encoded files or parsed document chunks without ownership verification, enabling cross-t...

CVE-2026-85671 QAnything 2.0.0 Unauthenticated Cross-User File Disclosure

QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/localdocqa/getfilebase64 and /api/localdocqa/getdoc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and...

EUVD-2026-71127

QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/localdocqa/getfilebase64 and /api/localdocqa/getdoc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and...

EUVD-2026-71116

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS...

CVE-2026-85660

cli-mcp-server 0.2.5 contains a command allowlist bypass in the _validate_command_with_operators function. When ALLOW_SHELL_OPERATORS is enabled, an attacker can inject shell command substitution syntax such as $(...) or backticks to execute commands that are not on the ALLOWED_COMMANDS allowlist...

CVE-2026-85660 cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS...

CVE-2026-85622

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership in the establish_ws_connection_v2 WebSocket handler. This allows any authenticated user to bind a session to a workspace they do not belong to, then send sync Manifest messages with victim object identifiers to read full documen...

CVE-2026-85623 goose 1.37.0 Arbitrary Command Execution via Recipe Extensions

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

CVE-2026-85623

goose v1.37.0 (by aaif-goose) contains an arbitrary command execution flaw in its recipe subsystem. The vulnerable components are stdio extensions and retry.checks within recipes, which are executed without passing through the recipe security scan—creating a bypass for attackers who distribute ma...

CVE-2026-85621 LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu

LobeChat LobeHub 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route /api/agent/webhooks/:platform is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verificatio...

CVE-2026-85621

LobeChat (LobeHub) 2.2.1 has an improper webhook signature verification flaw in its QQ and Feishu adapters . The webhook route (/api/agent/webhooks/:platform) is unauthenticated by design and delegates verification to each adapter. The QQ adapter performs no Ed25519 signature verification on disp...

CVE-2026-85621 LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu

LobeChat LobeHub 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route /api/agent/webhooks/:platform is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verificatio...

EUVD-2026-71227

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pgreadfile through FROM-clause syntax to read arbitrary files despite restricted-mode...

CVE-2026-85619 AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read...

EUVD-2026-71226

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read...

CVE-2026-85619 AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read...

CVE-2026-85620

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass in its SQL validation layer. The root cause is that function-name validation is not applied to RangeFunction nodes in FROM clauses , allowing attackers to invoke file-reading functions such as pg_read_file via FROM-clause syntax and read ar...

CVE-2026-85619

AppFlowy-Cloud 0.9.64 contains an authorization bypass in its collaboration object access control (libs/access-control/src/casbin/collab.rs). The service fails to verify that requested collab objects belong to the caller's workspace, allowing an authenticated attacker to supply a victim's object ...