#advisory

共收录 23717 条相关情报。

安全公告2026-09-05 发布INFO

APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard

CVE-2026-86120

APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to en

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-636

安全公告2026-09-05 发布INFO

Webstudio through 0.296.0 SSRF via /cgi proxy routes

CVE-2026-86119

Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

安全公告2026-09-05 发布INFO

gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint

CVE-2026-86118

gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authentic

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-09-05 发布INFO

Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

CVE-2026-86116

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any a

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-09-05 发布INFO

Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path

CVE-2026-86115

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skippi

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-441

安全公告2026-09-05 发布INFO

Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints

CVE-2026-86114

Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to creat

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-09-05 发布INFO

BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Records

CVE-2026-86113

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authe

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-09-05 发布INFO

BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints

CVE-2026-86112

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing auth

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-09-05 发布INFO

BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses

CVE-2026-86111

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-09-05 发布INFO

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode...

CVE-2026-84931

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before