#cwe-200

共收录 1704 条相关情报。

← 返回所有主题

漏洞预警2026-10-06 发布INFO

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the t...

CVE-2026-86786

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

安全公告2026-10-06 发布INFO

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this...

CVE-2026-105707

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-200 #severity:medium

漏洞预警2026-10-06 发布INFO

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/user_handler.go. The manipulat...

CVE-2026-105707

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-209

安全公告2026-10-06 发布INFO

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

CVE-2026-105752

## Affected - **Ecosystem / package:** pip / `vllm` - **Affected versions:** vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-200 #cwe-524 #severity:low

漏洞预警2026-10-05 发布INFO

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-t...

CVE-2026-105752

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-524

安全公告2026-10-05 发布INFO

vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

CVE-2026-100723

## Summary When an application explicitly exposes Node's `zlib` module through vm2's `NodeVM` builtin allowlist, an unt

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-200 #cwe-787 #severity:medium

漏洞预警2026-10-05 发布INFO

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DO...

CVE-2026-105748

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

历史摘要 · 未重新核验 · NVD

#cve #cwe-73 #cwe-200

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissio...

CVE-2026-105684

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread,

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check,...

CVE-2026-105639

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for an

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-287 #cwe-639

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [Al...

CVE-2026-105635

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/proje

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284 #cwe-862

安全公告2026-10-05 发布INFO

Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

CVE-2026-105639

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for an

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-287 #cwe-639

安全公告2026-10-05 发布INFO

Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

CVE-2026-105635

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/proje

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-284 #cwe-862

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/{slug}/modules/ throu...

CVE-2026-104963

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyc

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

安全公告2026-10-05 发布INFO

Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member

CVE-2026-104963

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyc

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-863

漏洞预警2026-10-05 发布INFO

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a docum...

CVE-2026-63270

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information c

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-05 发布INFO

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read t...

CVE-2026-63269

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-918

漏洞预警2026-10-05 发布INFO

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a dat...

CVE-2026-63268

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-05 发布INFO

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a doc...

CVE-2026-63267

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a lin

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-918

漏洞预警2026-10-05 发布INFO

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a request...

CVE-2026-105302

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occu

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

安全公告2026-10-04 发布INFO

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows...

CVE-2026-105211

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-200 #severity:critical