Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1310 CNY

100%
Buy Us a Coffee

UFO — Vulnerabilities & Security Advisories 6

All 6 CVE vulnerabilities found in UFO, with AI-generated Chinese analysis, references, and POCs.

Vendor: microsoft

CVE IDTitleCVSSSeverityPublished
CVE-2026-46538 Microsoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injection CWE-294 5.9 Medium2026-05-27
CVE-2026-46416 Microsoft UFO shared WebSocket handler state causes cross-client response hijacking CWE-284 6.3 Medium2026-05-27
CVE-2026-46414 Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking CWE-290 8.8 High2026-05-27
CVE-2026-46402 Microsoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directory CWE-22 8.1 High2026-05-27
CVE-2026-46544 Microsoft UFO reuses client-supplied WebSocket session IDs and replays stale task results to new authenticated requesters CWE-639 5.3 Medium2026-05-27
CVE-2026-45322 OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSON CWE-78 7.8 High2026-05-27

All 6 known CVE vulnerabilities affecting UFO with full Chinese analysis, references, and POCs where available.