pyLoad 安全漏洞

pyLoad is an open-source download manager written in Python. Versions of pyLoad prior to 0.5.0b3.dev98 contained security vulnerabilities. These vulnerabilities stemmed from the lack of verification of the X-Forwarded-Proto header’s source, leading to race conditions in a multi-threaded...

PT-2026-41174

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0 Description An issue exists where administrators' restrictions on API endpoint access can be bypassed. While requests using the Authorization: Bearer header are correctly blocked when restricted from the...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011249)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011249 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGACMDMAXDATASIZE This data originates from...

CVE-2026-35587

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, a Server-Side Request Forgery SSRF vulnerability exists in the Glances IP plugin due to improper validation of the publicapi configuration parameter. The value of publicapi is used directly in outbound HTTP...

CVE-2026-35587 Glances IP Plugin has SSRF via public_api that leads to credential leakage

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, a Server-Side Request Forgery SSRF vulnerability exists in the Glances IP plugin due to improper validation of the publicapi configuration parameter. The value of publicapi is used directly in outbound HTTP...

CVE-2026-40196

HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the web interface correctly enforced the...

SUSE-SU-2026:21361-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-39998: scsi: target: targetcoreconfigfs: Add length check to avoid buffer overflow bsc1252073. - CVE-2025-40253: s390/ctcm: Fix double-kfree bsc1255084. -...

EUVD-2026-23840

A security vulnerability has been detected in rowboatlabs rowboat up to 0.1.67. This impacts the function toolcall of the file apps/experimental/toolswebhook/app.py of the component toolswebhook. Such manipulation of the argument X-Tools-JWE leads to improper authentication. The attack may be...

CVE-2026-5720

A flaw was found in miniupnpd. Remote attackers can exploit an integer underflow vulnerability during the parsing of the SOAPAction header by sending a specially crafted malformed header that includes a single quote. This improper length validation can lead to an out-of-bounds memory read,...

Langflow vulnerable to injection

A vulnerability was detected in langflow-ai langflow up to 1.8.3. The impacted element is the function getclientip/installmcpconfig of the file src/backend/base/langflow/api/v1/mcpprojects.py of the component Model Context Protocol Configuration API. Performing a manipulation of the argument...

CVE-2026-6599

The CVE-2026-6599 entry concerns langflow-ai langflow (up to v1.8.3) with a flaw in the Model Context Protocol Configuration API. The affected element is the file src/backend/base/langflow/api/v1/mcp_projects.py, specifically the install_mcp_config function (and mention of get_client_ip). Manipul...

PT-2026-33705

Name of the Vulnerable Software and Affected Versions langflow-ai langflow versions prior to 1.8.4 Description An issue exists in the Model Context Protocol Configuration API within the get client ip/install mcp config functions of the file src/backend/base/langflow/api/v1/mcp projects.py. A remo...

The vulnerability of the enhanceRequest function in the Fastify Node.js software framework allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the enhanceRequest function in the Fastify Node.js software framework is related to the occurrence of interpretation conflicts when processing HTTP header names and values. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, an...

RLSA-2026:8471 Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.106 and .NET Runtime...

MiracleLinux 8 : nodejs:20 (AXSA:2026-464:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-464:01 advisory. minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-26996 minimatch: Minimatch: Denial of Service via catastrophic...

Exploit for CVE-2026-4631

CVE-2026-4631 — Code Analysis Cockpit: Unauthenticated Rem...

Rate-limit bypass on POST /api/v1/login via X-Forwarded-For rotation

What's wrong The rate limiter on the login endpoint keys each request by request.client.host. Uvicorn is launched with --proxy-headers --forwarded-allow-ips in docker/base.Dockerfile, so request.client.host is whatever the client puts in the X-Forwarded-For header. An attacker just rotates that...

CVE-2026-40490

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When redirect following is enabled followRedirecttrue, versions of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers...

EUVD-2026-23638

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When redirect following is enabled followRedirecttrue, versions of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers...

CVE-2026-40490 AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When redirect following is enabled followRedirecttrue, versions of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers...