#cwe-200

共收录 1690 条相关情报。

漏洞预警2026-10-13 发布INFO

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes...

CVE-2026-85733

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker ima

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-13 发布INFO

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.hea...

CVE-2026-103030

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

安全公告2026-10-13 发布INFO

FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables

CVE-2026-85733

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker ima

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200

漏洞预警2026-10-13 发布INFO

A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to informatio...

CVE-2026-109526

A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component e

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284

漏洞预警2026-10-13 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/...

CVE-2026-102981

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-639

安全公告2026-10-13 发布INFO

Plane: Unauthenticated Workspace Invitation Token Leakage

CVE-2026-102981

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-639

安全公告2026-10-13 发布INFO

HBAI-Ltd Toonflow-app exportData Endpoint information disclosure

CVE-2026-109526

A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component e

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-284

漏洞预警2026-10-13 发布INFO

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (AC...

CVE-2026-77362

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools d

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-10-13 发布INFO

Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment ...

CVE-2026-74047

Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with ag

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-13 发布INFO

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching ...

CVE-2026-109959

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited fie

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-13 发布INFO

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search ...

CVE-2026-109958

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read re

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-13 发布INFO

FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory. Se...

CVE-2026-109948

FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call th

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

安全公告2026-10-13 发布INFO

obsidian-tc bridge tools expose data outside the read ACL

CVE-2026-77362

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools d

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-863

安全公告2026-10-13 发布INFO

Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint

CVE-2026-74047

Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with ag

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200

安全公告2026-10-13 发布INFO

EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint

CVE-2026-109959

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited fie

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200

安全公告2026-10-13 发布INFO

EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search

CVE-2026-109958

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read re

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200

安全公告2026-10-13 发布INFO

FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection

CVE-2026-109948

FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call th

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200

漏洞预警2026-10-13 发布INFO

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109777

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-13 发布INFO

Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVE-2026-109771

Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-13 发布INFO

Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVE-2026-109769

Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 1

历史摘要 · 未重新核验 · NVD

#cve #cwe-200