#CVE

共收录 56479 条相关情报。

漏洞预警2026-10-30 发布MEDIUM

Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied ...

CVE-2026-119664

Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsM

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated us...

CVE-2026-119663

Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connect

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布HIGH

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin p...

CVE-2026-119662

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to au

来源摘录 · NVD

#cve #cwe-798

漏洞预警2026-10-30 发布MEDIUM

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry...

CVE-2026-119661

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布CRITICAL

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'm...

CVE-2026-119660

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admi

来源摘录 · NVD

#cve #cwe-1394

漏洞预警2026-10-30 发布MEDIUM

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on...

CVE-2026-119659

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other us

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by sup...

CVE-2026-119658

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role acco

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuse...

CVE-2026-119657

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布HIGH

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORD...

CVE-2026-119656

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPag

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布HIGH

CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY...

CVE-2026-119655

CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布HIGH

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu managem...

CVE-2026-119654

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate p

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autoc...

CVE-2026-119653

Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend l...

CVE-2026-119652

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by ...

CVE-2026-119651

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allo

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings...

CVE-2026-119650

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows au

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布HIGH

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contri...

CVE-2026-119649

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolder

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布MEDIUM

Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/...

CVE-2026-119648

Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-30 发布MEDIUM

RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other dep...

CVE-2026-119647

RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept t

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction rep...

CVE-2026-119646

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other s

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access check...

CVE-2026-119645

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated us

来源摘录 · NVD

#cve #cwe-639