42 matches found
CVE-2026-124587
A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the...
EUVD-2026-119895
A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the...
CVE-2026-124587
A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the...
CVE-2026-124587 elizaOS eliza HTTP Server api-base-owner.ts information disclosure
A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the...
CVE-2026-124587 elizaOS eliza HTTP Server api-base-owner.ts information disclosure
A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the...
CVE-2026-124587
A vulnerability exists in elizaOS eliza 2.0.3-beta.7 affecting the HTTP Server component. Specifically, an unknown function within the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts can be manipulated to cause information disclosure . This issue can be triggered via a remo...
CVE-2026-124587 elizaOS eliza HTTP Server api-base-owner.ts information disclosure
A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the...
CVE-2026-124587: elizaOS eliza: A vulnerability was identified in elizaOS eliza 2.0.3-beta.7
A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the...
PT-2026-140314
A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the...
CVE-2026-112004
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...
CVE-2026-112004 Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...
EUVD-2026-103457
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...
CVE-2026-112004
The Teable application, in versions prior to 2026-10-12T12-45-53Z.3331 , is vulnerable to an authorization bypass via the folder rename endpoint. The root cause is that the PATCH /api/base/:baseId/node/folder/:folderId endpoint only validates the base|update permission against the :baseId provide...
CVE-2026-112004 Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...
CVE-2026-112004 Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...
CVE-2026-112004: Authorization Bypass Through User-Controlled Key
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...
PT-2026-116608
Name of the Vulnerable Software and Affected Versions Teable versions prior to 2026-10-12T12-45-53Z.3331 Description An authorization bypass allows authenticated users to rename folders in bases to which they do not belong. This occurs because the PATCH '/api/base/:baseId/node/folder/:folderId'...
Teable authorization issue vulnerability
The teable component has an authorization vulnerability. This vulnerability stems from the PATCH endpoint /api/base/:baseId/node/folder/:folderId, which only checks the base|update permission based on the baseId in the URL. Certified users can rename folders in a base with no membership by...
PT-2026-105826
Summary A server-side request forgery in LiteLLM Proxy lets an authenticated caller redirect the proxy's outbound request to a host of their choosing by smuggling an api base inside the user config request body, bypassing the existing parameter guard. Details LiteLLM Proxy validates request bodie...
PT-2026-93896
Name of the Vulnerable Software and Affected Versions LiteLLM versions prior to 1.83.9 Description LiteLLM Proxy is susceptible to Server-Side Request Forgery SSRF, a condition where an attacker can induce the server to make requests to an unintended location. An authenticated caller with a valid...