Google Cloud AlloyDB for PostgreSQL 安全漏洞

Google Cloud AlloyDB for PostgreSQL is a cloud-native, high-performance relational database service from Google Inc. That service is compatible with PostgreSQL. Versions of Google Cloud AlloyDB for PostgreSQL prior to 2025-11-03 contained a security vulnerability. This vulnerability stemmed from...

PT-2026-40453

Name of the Vulnerable Software and Affected Versions Linux ksmbd affected versions not specified Description A remote memory corruption issue exists in the ACL inheritance path. Remote clients with directory creation permissions can trigger a heap out-of-bounds read and subsequent heap corruptio...

mem0 安全漏洞

mem0 is an open-source benchmark tool for efficient memory algorithms developed by Mem0. Version 1.0.0 of mem0 contains a security vulnerability. This vulnerability stems from the lack of authentication and authorization controls in the memory creation API endpoints, which may allow remote...

CVE-2026-31245

The issue affects the mem0 1.0.0 server. The memory creation API (POST /memories) lacks authentication and authorization, allowing unauthenticated users to submit arbitrary memory records. This can lead to unauthorized data injection and potential data pollution in the database. Root cause: missi...

Chitora Lhaz 路径遍历漏洞

Chitora Lhaz is a Windows compression tool developed by Chitora Company in Japan. It supports the creation of files in various compression formats and the decompression of those files. Chitora Lhaz has a path traversal vulnerability. This vulnerability stems from an issue with the automatic folde...

CVE-2026-31243

The mem0 1.0.0 server lacks authentication and authorization controls for its memory reset and table re-creation functionality accessible via the DELETE /memories endpoint. An unauthenticated attacker can send a DELETE request that triggers a reset operation, leading to the execution of a CREATE...

PT-2026-40322

Name of the Vulnerable Software and Affected Versions mem0 version 1.0.0 Description The server lacks authentication and authorization controls for the memory creation API endpoint "POST /memories". This allows unauthenticated users to submit arbitrary memory records without identity or permissio...

CVE-2026-31245

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint POST /memories. The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending...

PT-2026-39936

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic folder creation feature enabled, and a product user tries to extract an archive file which has a crafted file name,...

CVE-2026-8161

creationtimestamp| type| source ---|---|--- 2026-05-11 23:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/83859 2026-05-11 23:00:11+00:00| seen| Telegram/e-kNblg5cCIACsW4hX0Z7Izc7Q-BrD-tkcFevHWmjItb6g 2026-05-12 03:00:06+00:00| seen|...

CVE-2026-24449

creationtimestamp| type| source ---|---|--- 2026-05-11 22:15:50+00:00| seen| https://jvn.jp/en/jp/JVN94012927...

CVE-2024-26258

creationtimestamp| type| source ---|---|--- 2026-05-11 22:15:20+00:00| seen| https://jvn.jp/en/vu/JVNVU95381465...

CVE-2024-25568

creationtimestamp| type| source ---|---|--- 2026-05-11 22:15:20+00:00| seen| https://jvn.jp/en/vu/JVNVU95381465...

CVE-2026-42872

creationtimestamp| type| source ---|---|--- 2026-05-11 21:27:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlm7okusjp2o...

CVE-2026-42887

creationtimestamp| type| source ---|---|--- 2026-05-11 21:25:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlm7lupnk52e...

CVE-2026-42888

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the podcast creation endpoint at server/controllers/PodcastController.js accepts a user-controlled file path without sufficient boundary validation to ensure it remains within the intended library directory. This...

EUVD-2026-29333

Outline is a service that allows for collaborative documentation. Prior to 1.7.0, the shares.create API accepts both collectionId and documentId simultaneously and, when published=false, only verifies read access for each—skipping the "share" permission check. A subsequent shares.update authorize...

CVE-2026-43890 Outline: IDOR in subscriptions.create allows cross-tenant subscription on private documents (sibling of GHSA-23jj-rp48-w7q7)

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.7.0, the subscriptions.create API endpoint in server/routes/api/subscriptions/subscriptions.ts exhibits a broken authorization pattern. When both collectionId and documentId are supplied in the request, the route...

CVE-2026-43890 Outline: IDOR in subscriptions.create allows cross-tenant subscription on private documents (sibling of GHSA-23jj-rp48-w7q7)

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.7.0, the subscriptions.create API endpoint in server/routes/api/subscriptions/subscriptions.ts exhibits a broken authorization pattern. When both collectionId and documentId are supplied in the request, the route...

CVE-2026-43988

creationtimestamp| type| source ---|---|--- 2026-05-11 20:29:17+00:00| seen| https://gist.github.com/tw89Coder/cd011dc1842625f821c171e41e812fbc 2026-05-27 04:01:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmsmovh4ot2z...