https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 06 Nov 2026 16:10:32 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-121938 <p>langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users&#39; character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims&#39; questions, AI answers, and attachment and audio URLs.</p> <p>langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users&#39; character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims&#39; questions, AI answers, and attachment and audio URLs.</p> https://db.gcve.eu/vuln/fkie_cve-2026-121938 https://db.gcve.eu/vuln/ghsa-j5gc-wvrm-78hc <p>langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users&#39; character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims&#39; questions, AI answers, and attachment and audio URLs.</p> <p>langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users&#39; character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims&#39; questions, AI answers, and attachment and audio URLs.</p> https://db.gcve.eu/vuln/ghsa-j5gc-wvrm-78hc