| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-72813 | - | actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an em | 2026-10-29 21:17:32 | 2026-08-14 12:16:44 |
| CVE-2026-73608 | 8.6 | SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4-alpha.3) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is regist | 2026-10-29 21:17:32 | 2026-08-13 12:17:25 |
| CVE-2026-72791 | 5.8 | SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applie | 2026-10-29 21:17:31 | 2026-08-12 20:17:50 |
| CVE-2026-72775 | 8.8 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An | 2026-10-29 21:17:31 | 2026-08-11 13:19:08 |
| CVE-2026-72774 | 6.5 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type vi | 2026-10-29 21:17:31 | 2026-08-11 13:19:07 |
| CVE-2026-72773 | 7.7 | n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-directory confinement check and expand to locations outside the config | 2026-10-29 21:17:31 | 2026-08-11 13:19:07 |
| CVE-2026-72772 | 8.8 | n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email clai | 2026-10-29 21:17:31 | 2026-08-11 13:19:07 |
| CVE-2026-72771 | 6.5 | n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM nodes when user-supplied base or endpoint URLs are configured. Low-privileged workflow editors with use-only access to shared credentials can | 2026-10-29 21:17:31 | 2026-08-11 13:19:07 |
| CVE-2026-70640 | 7.0 | llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B con | 2026-10-29 21:17:31 | 2026-08-06 22:18:28 |
| CVE-2026-70639 | 5.5 | llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malic | 2026-10-29 21:17:31 | 2026-08-06 22:18:28 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39953
Zapisa po stranici: