CVE-2026-23522

CVE-2026-23522 affects LobeChat. Prior to version 2.0.0-next.193, the tRPC endpoint knowledgeBase.removeFilesFromKnowledgeBase lacks ownership verification because the userId filter in the DB query is commented out, enabling an authenticated user to delete files from other users’ knowledge bases ...

CVE-2026-23522 Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion

LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, knowledgeBase.removeFilesFromKnowledgeBase tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership. userId filter in the database query is commented out, so it's...

CVE-2026-23522 Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion

LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, knowledgeBase.removeFilesFromKnowledgeBase tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership. userId filter in the database query is commented out, so it's...

CVE-2026-23522 Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion

LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, knowledgeBase.removeFilesFromKnowledgeBase tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership. userId filter in the database query is commented out, so it's...

CVE-2026-23522

LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, knowledgeBase.removeFilesFromKnowledgeBase tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership. userId filter in the database query is commented out, so it's...

CVE-2026-1190

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language SAML setup, it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML...

GHSA-6VFR-P2HX-6V32 Apache Linkis: Password Exposure

When org.apache.linkis.metadata.util.HiveUtils.decode fails to perform Base64 decoding, it records the complete input parameter string in the log via logger.errorstr + "decode failed", e. If the input parameter contains sensitive information such as Hive Metastore keys, plaintext passwords will b...

Apache Linkis: Password Exposure

When org.apache.linkis.metadata.util.HiveUtils.decode fails to perform Base64 decoding, it records the complete input parameter string in the log via logger.errorstr + "decode failed", e. If the input parameter contains sensitive information such as Hive Metastore keys, plaintext passwords will b...

CVE-2025-59355

A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode fails to perform Base64 decoding, it records the complete input parameter string in the log via logger.errorstr + "decode failed", e. If the input parameter contains sensitive information such as Hive Metastore keys, plaintext...

PT-2026-3503

Name of the Vulnerable Software and Affected Versions CrawlChat versions prior to 0.0.8 Description CrawlChat is a platform that converts technical documentation into intelligent chatbots. Before version 0.0.8, a missing permission check in the Discord bot component allowed users without...

CrawlChat security vulnerability

CrawlChat is an open-source tool developed by CrawlChat that combines web scrapers with AI chatbots. Versions of CrawlChat prior to 0.0.8 contained security vulnerabilities. These vulnerabilities stemmed from the lack of permission checks in CrawlChat’s Discord bot, allowing non-managed server...

PT-2026-3454

Name of the Vulnerable Software and Affected Versions LobeChat versions prior to 2.0.0-next.193 Description LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, the knowledgeBase.removeFilesFromKnowledgeBase tRPC endpoint allows authenticated users to delete file...

MiracleLinux 8 : qt5-qtbase-5.12.5-6.el8, qt5-qttools-5.12.5-2.el8, qt5-qtwebsockets-5.12.5-2.el8 (AXSA:2021-1450:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1450:01 advisory. qt: XML entity expansion vulnerability CVE-2015-9541 qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages...

MiracleLinux 8 : qt5-qtbase-5.12.5-8.el8 (AXSA:2021-2099:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-2099:01 advisory. qt: buffer over-read in readxbmbody in gui/image/qxbmhandler.cpp CVE-2020-17507 Tenable has extracted the preceding description block directly from the...

MiracleLinux 4 : 389-ds-base-1.2.11.15-95.AXS4 (AXSA:2018-3037:03)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-3037:03 advisory. 389-ds-base: ns-slapd crash via large filter value in ldapsearch CVE-2018-1089 Tenable has extracted the preceding description block directly from the...

OSV-2026-86 Security exception in java.base/java.util.Arrays.copyOfRange

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476431399 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOfRange org.apache.poi.util.IOUtils.safelyClone org.apache.poi.ddf.EscherBlipRecord.setPictureData...

Malicious Package

Overview base-ui-vue3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Security Bulletin: Multiple security vulnerabilities in RedHat UBI affect IBM Robotic Process Automation for Cloud Pak

Summary Multiple vulnerabilities in RedHat UBI affect IBM Robotic Process Automation for Cloud Pak. RedHat UBI is used as base image for IBM Robotic Process Automation for Cloud Pak images. This bulletin identifies the fixes required to address the vulnerabilites. Vulnerability Details...

OESA-2026-1083 assimp security update

Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose. Security Fixes: A weakness has been identified in Op...

Malicious code in base-ui-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02dfd5d7f28a3a6c1911e9b745f0114967cd677bea80bbfc7c490e6bf1f09ddf The package base-ui-vue3 was found to contain malicious code. Source: ghsa-malware 88f9d0f6ba47ed2a8d641427839b31d3b2debfea9d13f32125734f392a0838d9 A...