CVE-2025-46818

CVE-2025-46818 – Redis Lua 沙箱跨用户逃逸 通过 Redis 8.2.1 中已弃用的 Lua API 和可变元表实现沙箱逃逸。 概述 Redis 8.2.1 仍向脚本暴露已弃用的 Lua 内置函数（getfenv、setfenv、newproxy），且未能锁定基本类型的元表。攻击者可以向共享元表中注入方法、捕获特权环境，并以其他用户的权限执行命令。 环境 Redis 服务器 8.2.1（或 8.2.2 之前的任何受影响版本） redis-cli 可本地网络访问 Redis 实例 文件 CVE-2025-46818.lua –...

CVE-2026-33555

HAProxy H3/QUIC 独立 FIN 请求体校验绕过导致的 HTTP 请求走私 完整文章请见：https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html 摘要 HAProxy 的 HTTP/3 实现中存在一个漏洞，允许攻击者发送一个 Content-Length 头与实际请求体大小不匹配的 HTTP 请求。HAProxy 会将该畸形请求以声明的 Content-Length 但零请求体字节的形式，通过 HTTP/1.1 转发到后端。当后端发送早期响应（例如 301 重定向）并从...

EUVD-2026-80775

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2scalendarmovepost AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2sposts table using only the attacker-supplied b2sid primary key with...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation 在 memory APIs 中缺少所有权检查，允许跨用户的内存读取和删除。 主要公告： GHSA-qv97-83w4-ff86 研究人员致谢： @chaitanyagarware 概览 字段| 值 ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 项目| vmDeshpande/ai-agent-automation 包| backend 生态系统| npm 严重性| 高 CVSS| 8.8,...

CVE-2024-52317

🚨🚨CVE-2024-52317🚨🚨 CVE-2024-52317 - Apache Tomcat HTTP/2 数据泄露漏洞 概述 CVE-2024-52317 是一个影响 Apache Tomcat HTTP/2 实现的漏洞。该问题源于 HTTP/2 请求与响应资源的不当回收，可能导致用户间数据泄露。这意味着一个用户的敏感数据可能出现在发送给另一个用户的响应中。 受影响版本 以下 Apache Tomcat 版本受此漏洞影响： 版本系列| 受影响版本 ---|--- Apache Tomcat 11.0| 11.0.0 之前的版本 Apache Tomcat 10.1| 10.1.3...

CVE-2024-11222 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

CVE-2024-11222

GitLab CE/EE is affected by a Time-of-check Time-of-use (TOCTOU) race condition in pipeline creation, impacting versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 . Under certain conditions, a developer user could perform actions in the context of another user's merge re...

CVE-2026-76855 Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7webauthlogdumpcgi.c, auditgetcgi.c, and moddispatchauth/plan.json. Attackers can query these audit components to obtain other users' session and browsing history data...

CVE-2026-76855

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in its audit endpoints, specifically in l7_web_auth_log_dump_cgi.c , audit_get_cgi.c , and mod_dispatch_auth/plan.json . Attackers with low privileges can query these components to obtain other users' ses...

CVE-2026-12763

IBM Langflow OSS (versions 1.0.0 through 1.11.5) is affected by improper cache key isolation in the MCP Tools component . The component caches discovered MCP tools in a shared process-local cache keyed only by the MCP server display name, without incorporating the user, session, flow, or resolved...

CVE-2026-55235

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

CVE-2026-55235

langgraph-api (the LangGraph Server runtime) prior to 0.10.0 allows a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport. The authentication middleware treats this transport as internal, so the webhook reaches the server's own thread and ru...

CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

EUVD-2026-76989

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

EUVD-2026-76244

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...

CVE-2026-49463 NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...

CVE-2026-89257

AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory() capability and a CSRF nonce but omits the Category::userCanEditCategory() ownership check enforced by the s...

n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

Impact The endpoint /rest/active-workflows returned every active workflow ID on the instance to any member, regardless of sharing, and workflow activation, deactivation and publication push events were broadcast to every connected client, carrying workflow IDs, version IDs and activation-error...

NPM: n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

NPM: n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...

EUVD-2026-75723

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...