61131 matches found
FastGPT 安全漏洞
FastGPT is an open-source knowledge base question-answering system based on large language models developed by Labring. Versions of FastGPT 4.14.7 and earlier contain security vulnerabilities. These vulnerabilities stem from the protective measures in the Python sandbox, which can be circumvented...
CVE-2026-29793
creationtimestamp| type| source ---|---|--- 2026-03-10 22:40:05+00:00| seen| https://gist.github.com/alon710/b3f6f3a2d0a03d351cf9f1e0f3b1967e 2026-03-21 02:38:04+00:00| seen| https://bsky.app/profile/secqube.com/post/3mhjyshcne72j...
GHSA-QMW5-2P58-XVRC
creationtimestamp| type| source ---|---|--- 2026-03-10 21:40:05+00:00| seen| https://gist.github.com/alon710/c10cdbd73c5cbd65710762162e90e072...
CVE-2026-30953
LinkAce is a self-hosted archive to collect website links. When a user creates a link via POST /links, the server fetches HTML metadata from the provided URL LinkRepository::create calls HtmlMeta::getFromUrl. The LinkStoreRequest validation rules do not include NoPrivateIpRule, allowing server-si...
K000160290: PostgreSQL vulnerability CVE-2025-12817
Security Advisory Description Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, woul...
EUVD-2026-10874
LinkAce is a self-hosted archive to collect website links. When a user creates a link via POST /links, the server fetches HTML metadata from the provided URL LinkRepository::create calls HtmlMeta::getFromUrl. The LinkStoreRequest validation rules do not include NoPrivateIpRule, allowing server-si...
CVE-2026-30953
LinkAce is a self-hosted archive to collect website links. When a user creates a link via POST /links, the server fetches HTML metadata from the provided URL LinkRepository::create calls HtmlMeta::getFromUrl. The LinkStoreRequest validation rules do not include NoPrivateIpRule, allowing server-si...
CVE-2026-30953 LinkAce affected by SSRF via link creation: NoPrivateIpRule not applied to LinkStoreRequest
LinkAce is a self-hosted archive to collect website links. When a user creates a link via POST /links, the server fetches HTML metadata from the provided URL LinkRepository::create calls HtmlMeta::getFromUrl. The LinkStoreRequest validation rules do not include NoPrivateIpRule, allowing server-si...
EUVD-2026-10875
LinkAce is a self-hosted archive to collect website links. When a user creates a link via POST /links, the server fetches HTML metadata from the provided URL LinkRepository::create calls HtmlMeta::getFromUrl. The LinkStoreRequest validation rules do not include NoPrivateIpRule, allowing server-si...
CVE-2026-30953 LinkAce affected by SSRF via link creation: NoPrivateIpRule not applied to LinkStoreRequest
LinkAce is a self-hosted archive to collect website links. When a user creates a link via POST /links, the server fetches HTML metadata from the provided URL LinkRepository::create calls HtmlMeta::getFromUrl. The LinkStoreRequest validation rules do not include NoPrivateIpRule, allowing server-si...
GHSA-7R34-79R5-RCC9
creationtimestamp| type| source ---|---|--- 2026-03-10 19:40:06+00:00| seen| https://gist.github.com/alon710/466922a78fd1f1a990595c00598870a1...
CVE-2026-30944
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocmsapi/dashboard/api-tokens endpoint allows any authenticated user at least Editor to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to...
StudioCMS has Privilege Escalation via Insecure API Token Generation
Summary The /studiocmsapi/dashboard/api-tokens endpoint allows any authenticated user at least Editor to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target us...
CVE-2026-30974
creationtimestamp| type| source ---|---|--- 2026-03-10 18:10:05+00:00| seen| https://gist.github.com/alon710/9a8802d53b5fb158c5f6cb0e8400fffd...
GHSA-M6HV-X64C-27MM
creationtimestamp| type| source ---|---|--- 2026-03-10 18:10:05+00:00| seen| https://gist.github.com/alon710/9a8802d53b5fb158c5f6cb0e8400fffd...
CVE-2026-30920
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installationid values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the...
CVE-2026-30970
CVE-2026-30970 affects Coral Server. Before version 1.1.0, the /api/v1/sessions endpoint allowed session creation without strong authentication, performing resource-intensive operations (container spawning and memory context creation). An attacker with access to this endpoint could create session...
EUVD-2026-10708
Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server allowed the creation of agent sessions through the /api/v1/sessions endpoint without strong authentication. This endpoint perform...
CVE-2026-30970 Session authentication bypass in Coral Server session creation endpoint
Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server allowed the creation of agent sessions through the /api/v1/sessions endpoint without strong authentication. This endpoint perform...