Cyber Security Daily Radar

#cwe-200

共收录 1690 条相关情报。

← 返回所有主题
漏洞预警2026-10-12 发布INFO

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote aut...

CVE-2026-85966

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict acces

历史摘要 · 未重新核验 · NVD

#cve#cwe-200
漏洞预警2026-10-12 发布INFO

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Pa...

CVE-2026-109341

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permiss

历史摘要 · 未重新核验 · NVD

#cve#cwe-200
漏洞预警2026-10-12 发布INFO

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPU...

CVE-2026-109335

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read valu

历史摘要 · 未重新核验 · NVD

#cve#cwe-200
漏洞预警2026-10-12 发布INFO

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind...

CVE-2026-109325

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loop

历史摘要 · 未重新核验 · NVD

#cve#cwe-200
漏洞预警2026-10-12 发布INFO

Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list o...

CVE-2026-109315

Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Cloc

历史摘要 · 未重新核验 · NVD

#cve#cwe-200
漏洞预警2026-10-12 发布INFO

Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset rou...

CVE-2026-109314

Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain p

历史摘要 · 未重新核验 · NVD

#cve#cwe-200
漏洞预警2026-10-12 发布INFO

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument. Attack...

CVE-2026-109304

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig cr

历史摘要 · 未重新核验 · NVD

#cve#cwe-200
漏洞预警2026-10-12 发布INFO

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source...

CVE-2026-109293

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admi

历史摘要 · 未重新核验 · NVD

#cve#cwe-200
漏洞预警2026-10-12 发布INFO

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browse...

CVE-2026-109292

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to

历史摘要 · 未重新核验 · NVD

#cve#cwe-200
漏洞预警2026-10-12 发布INFO

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a craft...

CVE-2026-109259

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that

历史摘要 · 未重新核验 · NVD

#cve#cwe-200
安全公告2026-10-12 发布INFO

Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page

CVE-2026-109314

Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain p

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-200
安全公告2026-10-12 发布INFO

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument

CVE-2026-109304

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig cr

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-200
安全公告2026-10-12 发布INFO

Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint

CVE-2026-109293

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admi

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-200
安全公告2026-10-12 发布INFO

Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections

CVE-2026-109292

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-200
安全公告2026-10-12 发布INFO

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder

CVE-2026-109259

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-200
漏洞预警2026-10-12 发布INFO

A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes inform...

CVE-2026-108811

A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php.

历史摘要 · 未重新核验 · NVD

#cve#cwe-200#cwe-284
漏洞预警2026-10-12 发布INFO

A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the ...

CVE-2026-108810

A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the c

历史摘要 · 未重新核验 · NVD

#cve#cwe-200#cwe-284
安全公告2026-10-11 发布INFO

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP...

CVE-2026-108861

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the fiel

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-200#severity:medium
漏洞预警2026-10-11 发布INFO

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attacker...

CVE-2026-108861

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the fiel

历史摘要 · 未重新核验 · NVD

#cve#cwe-200
安全公告2026-10-11 发布INFO

Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool

CVE-2026-108861

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the fiel

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-200