#cwe-200

共收录 1717 条相关情报。

漏洞预警2026-09-27 发布MEDIUM

http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that d...

CVE-2026-100725

http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (clien

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-09-27 发布INFO

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. ...

CVE-2026-100723

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength ==

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

安全公告2026-09-26 发布INFO

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the...

CVE-2026-100719

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command t

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-200 #severity:high

安全公告2026-09-26 发布INFO

Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key...

CVE-2026-100708

Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in t

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-200 #severity:high

安全公告2026-09-26 发布INFO

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(),...

CVE-2026-100710

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDoma

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-200 #severity:medium

安全公告2026-09-26 发布INFO

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy...

CVE-2026-100703

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-200 #severity:high

漏洞预警2026-09-26 发布INFO

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API u...

CVE-2026-100719

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command t

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-26 发布INFO

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing()...

CVE-2026-100710

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDoma

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-26 发布INFO

Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificate...

CVE-2026-100708

Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in t

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-26 发布INFO

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries ...

CVE-2026-100703

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-26 发布INFO

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers ...

CVE-2026-100687

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table update

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-26 发布INFO

Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary loc...

CVE-2026-100680

Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validat

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-26 发布INFO

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by...

CVE-2026-100671

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Tw

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-26 发布INFO

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is on the sandbox allowlist but is registered without the n...

CVE-2026-100668

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-26 发布INFO

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboar...

CVE-2026-100640

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderer

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-26 发布INFO

Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields class-level permissio...

CVE-2026-100632

Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, Live

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-26 发布INFO

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download delete...

CVE-2026-100622

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file rea

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

安全公告2026-09-26 发布INFO

Froxlor before 2.3.12 Credential Disclosure via DirProtections API

CVE-2026-100719

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command t

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200

安全公告2026-09-26 发布INFO

Froxlor before 2.3.12 DKIM Private Key Disclosure via API

CVE-2026-100710

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDoma

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200

安全公告2026-09-26 发布INFO

Froxlor before 2.3.13 Private Key Disclosure via Certificates API

CVE-2026-100708

Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in t

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200