21 matches found
CVE-2026-45829
🚨 CVE-2026-45829 - ChromaDB 预认证远程代码执行 ChromaDB 向量数据库中的严重远程代码执行漏洞 📌 概述 CVE-2026-45829 是 ChromaDB （一款流行的开源 AI 向量数据库）中的一个严重预认证远程代码执行 漏洞。 未经身份验证的攻击者可以利用 ChromaDB 处理嵌入函数配置的方式，在服务器上实现完全远程代码执行 。 关键信息 项目| 详情 ---|--- CVE ID| CVE-2026-45829 严重性| 严重 CVSS 9.8 受影响组件| 嵌入函数处理器 攻击向量| 未认证 HTTP 请求 影响| 远程代码执行 RCE...
CVE-2026-19359
A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...
CVE-2026-19360
CVE-2026-19360 affects wongcyrus ExcelLexBot (versions up to 0.0.3) via the ExcelLexBotS3TriggerFunction in the Lambda Function Handler. The root cause is improper privilege management, with a remote-compatible attack vector described in the entry. The vulnerability impacts products that are no l...
CVE-2026-19359
A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...
EUVD-2026-54930
A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...
PT-2026-69301
Name of the Vulnerable Software and Affected Versions wongcyrus ExcelLexBot versions prior to 0.0.4 Description Improper privilege management exists within the Lambda Function Handler component, specifically affecting the ExcelLexBotS3TriggerFunction function. This issue allows a remote attacker ...
PT-2026-69300
Name of the Vulnerable Software and Affected Versions nxp-auto-goldvip gvip versions prior to 1.13.0 Description Improper access controls exist within the Lambda Function Handler component, specifically affecting the SitewiseCustomFunction function. This issue stems from an IAM permission...
CVE-2026-19360: Improper Privilege Management
A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3. This affects the function ExcelLexBotS3TriggerFunction of the component Lambda Function Handler. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The vendor was contacted...
CVE-2026-19359: Improper Access Control
A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...
CVE-2026-54619: Use After Free
sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version...
Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container
Summary Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which splits on : only — no path validation is applied to the module portion. During function build,...
PT-2026-45092
Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.7.8 Description A remote denial of service issue exists within the Shared NF-profile Parser component, specifically affecting the lib/sbi/nnrf-handler.c library. Manipulation of this component allows a remote attack...
CVE-2026-4957 OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file
A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handletoolcall of the file XAgent/functionhandler.py of the component API Key Handler. This manipulation of the argument apikey causes sensitive information in log files. The attack may be initiate...
CVE-2026-4957 OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file
A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handletoolcall of the file XAgent/functionhandler.py of the component API Key Handler. This manipulation of the argument apikey causes sensitive information in log files. The attack may be initiate...
XAgent 日志信息泄露漏洞
XAgent is an open-source, experimental large language model-driven autonomous agent developed by OpenBMB. Version XAgent 1.0.0 contains a vulnerability related to log information leakage, which stems from incorrect handling of the parameter apikey in the file XAgent/functionhandler.py. This could...
PT-2026-28683
A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle tool call of the file XAgent/function handler.py of the component API Key Handler. This manipulation of the argument api key causes sensitive information in log files. The attack may be...
CVE-2025-68387
Improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting XSS CAPEC-63 via a vulnerability a function handler in the Vega AST...
CVE-2025-68387
CVE-2025-68387 corresponds to Kibana, where an unauthenticated user can exploit an XSS flaw caused by improper input neutralization during web page generation in a function handler of the Vega AST evaluator . Several feeds (NVD, Red Hat, OSV, BIT-KIBANA, SNYK) describe the issue consistently and ...
CVE-2025-68387: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting XSS CAPEC-63 via a vulnerability a function handler in the Vega AST...
