#cwe-200

共收录 1690 条相关情报。

漏洞预警2026-10-06 发布INFO

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses an...

CVE-2026-105853

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary ve

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-06 发布INFO

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a col...

CVE-2026-105847

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary ve

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-639

安全公告2026-10-06 发布INFO

Payload: Token refresh and password reset responses may expose restricted user fields

CVE-2026-105853

## Impact Token refresh and password reset responses could return fields that the requesting user did not have access t

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-200 #severity:high

漏洞预警2026-10-06 发布INFO

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a rea...

CVE-2026-105805

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions befo

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

安全公告2026-10-06 发布INFO

Payload: Polymorphic join queries could disclose hidden fields

CVE-2026-105847

### Impact A user with query access could use polymorphic join filters to infer hidden or read-restricted field values,

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-200 #cwe-639 #severity:high

安全公告2026-10-06 发布INFO

Payload: Sort queries could expose protected field information

CVE-2026-105805

### Impact Under certain conditions, sorting readable records could reveal limited information about fields the requeste

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-200 #cwe-863 #severity:medium

漏洞预警2026-10-06 发布INFO

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the t...

CVE-2026-86786

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

安全公告2026-10-06 发布INFO

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this...

CVE-2026-105707

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-200 #severity:medium

漏洞预警2026-10-06 发布INFO

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/user_handler.go. The manipulat...

CVE-2026-105707

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-209

安全公告2026-10-06 发布INFO

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

CVE-2026-105752

## Affected - **Ecosystem / package:** pip / `vllm` - **Affected versions:** vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-200 #cwe-524 #severity:low

漏洞预警2026-10-05 发布INFO

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-t...

CVE-2026-105752

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-524

安全公告2026-10-05 发布INFO

vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

CVE-2026-100723

## Summary When an application explicitly exposes Node's `zlib` module through vm2's `NodeVM` builtin allowlist, an unt

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-200 #cwe-787 #severity:medium

漏洞预警2026-10-05 发布INFO

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DO...

CVE-2026-105748

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

历史摘要 · 未重新核验 · NVD

#cve #cwe-73 #cwe-200

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissio...

CVE-2026-105684

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread,

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check,...

CVE-2026-105639

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for an

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-287 #cwe-639

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [Al...

CVE-2026-105635

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/proje

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284 #cwe-862

安全公告2026-10-05 发布INFO

Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

CVE-2026-105639

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for an

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-287 #cwe-639

安全公告2026-10-05 发布INFO

Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

CVE-2026-105635

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/proje

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-284 #cwe-862

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/{slug}/modules/ throu...

CVE-2026-104963

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyc

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

安全公告2026-10-05 发布INFO

Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member

CVE-2026-104963

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyc

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-863