3630 matches found
Improper Authorization
Overview AstrBot is a 易上手的多平台 LLM 聊天机器人及开发框架 Affected versions of this package are vulnerable to Improper Authorization via the FutureTaskTool.call function in the Scheduled Task Handler process. An attacker can gain unauthorized access to sensitive operations by manipulating the payload"note"...
CVE-2026-15499
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/crontools.py of the component Scheduled Task Handler. Performing a manipulation of the argument payload"note" results in improper authorization...
EUVD-2026-43221
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/crontools.py of the component Scheduled Task Handler. Performing a manipulation of the argument payload"note" results in improper authorization...
CVE-2026-15499
AstrBotDevs AstrBot (versions up to 4.25.2) contains a vulnerability in the function FutureTaskTool.call (astrbot/core/tools/cron_tools.py). Manipulating payload["note"] leads to improper authorization, enabling remote exploitation. Public exploit availability is reported. No remediation details ...
CVE-2026-15499 AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/crontools.py of the component Scheduled Task Handler. Performing a manipulation of the argument payload"note" results in improper authorization...
PT-2026-57544
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/cron tools.py of the component Scheduled Task Handler. Performing a manipulation of the argument payload"note" results in improper authorization...
CVE-2026-54068
creationtimestamp| type| source ---|---|--- 2026-07-10 20:35:17+00:00| published-proof-of-concept| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gcm7-57gf-953c 2026-07-11 04:41:43+00:00| seen| https://gist.github.com/alon710/5b22d6c437eabc82b89ba6fa8ccee27d...
MINI-FPPM-XG8Q-2MP8
Bulletin has no description...
GHSA-HVR9-72V2-FFF3 SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist
Summary SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chrome/Chromium extension --...
MINI-P84J-CRMP-58V2
Bulletin has no description...
MINI-Q2WR-XXRV-CC8V
Bulletin has no description...
MINI-RXWR-3MHM-5J4V
Bulletin has no description...
MINI-VQ7V-5VRH-6CC4
Bulletin has no description...
MINI-R56M-PCXC-839V
Bulletin has no description...
SUSE-SU-2026:2837-1 Security update for libexif
This update for libexif fixes the following issues - CVE-2026-40385: Fixed information disclosure and crashes via integer overflow in Nikon MakerNote handling bsc1262000 - CVE-2026-40386: Fixed denial of service and information disclosure via integer underflow in MakerNote decoding bsc1262001 -...
PT-2026-57327
OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update widget a...
MINI-9MWH-38VC-48HG
Bulletin has no description...
MINI-F434-CPCQ-3WRM
Bulletin has no description...