ComfyUI 安全漏洞

ComfyUI is the most powerful and modular diffusion model GUI and backend developed by comfyanonymous individuals. Versions of ComfyUI prior to 0.13.0 contain security vulnerabilities, which stem from improper handling of the getuserdata function in the file app/usermanager.py. This vulnerability...

CVE-2026-6577

creationtimestamp| type| source ---|---|--- 2026-04-19 21:15:12+00:00| published-proof-of-concept| Telegram/ufJM6PGgYCZvMYI9YNw2SbGN8uW-GB10f-lGfe46lAW4 2026-04-19 21:29:13+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mjuvjsryko2e 2026-04-19 23:53:28+00:00| seen|...

CVE-2026-6569

creationtimestamp| type| source ---|---|--- 2026-04-19 12:45:12+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mjtyaskb5q23 2026-04-19 13:15:22+00:00| seen| Telegram/YgXeijrZB5WsTpBElNL5GhGy2ztSUOfDhY0-ECDYQWHxtTM 2026-04-19 13:52:54+00:00| seen|...

CVE-2026-0868

creationtimestamp| type| source ---|---|--- 2026-04-19 04:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116429489966778498 2026-04-19 04:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mjt4m7gd5s2j 2026-04-19 06:09:10+00:00| seen|...

Exploit for Improper Input Validation in Python

CVE-2023-24329 — Parser Differential Lab Educational use...

CVE-2026-6356

creationtimestamp| type| source ---|---|--- 2026-04-18 10:00:04+00:00| seen| https://t.me/GithubRedTeam/80797 2026-04-22 16:30:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3wa6gple2i 2026-04-22 19:14:24+00:00| seen|...

CVE-2026-41254

creationtimestamp| type| source ---|---|--- 2026-04-18 08:38:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjqzy43amm26 2026-04-29 12:45:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkn4w2vcol2q...

CVE-2026-40349 Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending isAdmin=true to PUT /settings/users/userId for their own user ID. The endpoint is intended to let a user ed...

EUVD-2026-23619

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending isAdmin=true to PUT /settings/users/userId for their own user ID. The endpoint is intended to let a user ed...

CVE-2026-40348

Movary contains an authenticated SSRF vulnerability present before version 0.71.1. An ordinary authenticated user can trigger server-side requests by sending a user-controlled URL to POST /settings/jellyfin/server-url-verify, which appends /system/info/public and causes the server to issue a requ...

CVE-2026-35402

creationtimestamp| type| source ---|---|--- 2026-04-17 22:26:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjpxscq4l32f...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the authentication process. An attacker can gain unauthorized access to multiple authenticated...

CVE-2026-6451

creationtimestamp| type| source ---|---|--- 2026-04-17 10:27:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjopm4miod2k 2026-04-17 12:32:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjowljd7yw2n...

CVE-2026-30457

creationtimestamp| type| source ---|---|--- 2026-04-17 06:35:41+00:00| seen| https://bsky.app/profile/breachandbuild.bsky.social/post/3mjocnufyha26...

Note Mark 安全漏洞

Note Mark is a web-based Markdown note-taking application developed by Leo Spratt. Versions of Note Mark prior to 0.19.1 contained a security vulnerability. This vulnerability stemmed from the login endpoint only performing bcrypt password verification when a username was provided. This allowed...

CVE-2026-40262

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XHTML. These files are served with an...

[SECURITY] Fedora 44 Update: spacebar-6.6.4-1.fc44

Spacebar is a telepathy-qt based SMS application that primarily targets Plasm a Mobile...

[SECURITY] Fedora 44 Update: kf6-kuserfeedback-6.25.0-1.fc44

Framework for collecting user feedback for apps via telemetry and surveys...

SQL Injection

Overview @saltcorn/mobile-app is a Saltcorn mobile app for Android and iOS Affected versions of this package are vulnerable to SQL Injection via the getSyncRows and getDelRows functions. An attacker can execute arbitrary SQL commands, exfiltrate sensitive data, modify or delete database contents,...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5) potentially affected by CVE-2026-41478 via @saltcorn/mobile-app (>=1.5.0, <=1.5.5-beta.0)

@saltcorn/mobile-app NPM version =1.5.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNMOBILEAPP-16110990...