#cwe-200

共收录 1721 条相关情报。

← 返回所有主题

漏洞预警2026-08-28 发布INFO

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email addres...

CVE-2026-14567

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowi

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-28 发布INFO

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and ...

CVE-2026-78174

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-priv

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-269 #cwe-532

漏洞预警2026-08-28 发布INFO

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API use...

CVE-2026-61802

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-522

漏洞预警2026-08-28 发布INFO

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-pr...

CVE-2026-61783

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

安全公告2026-08-27 发布INFO

Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config

CVE-2026-61802

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-522

安全公告2026-08-27 发布INFO

Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key

CVE-2026-61783

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-863

漏洞预警2026-08-27 发布INFO

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCred...

CVE-2026-77438

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public shar

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

安全公告2026-08-27 发布INFO

Trilium unauthenticated share-search discloses password-protected and hidden shared notes

CVE-2026-77438

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public shar

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-863

漏洞预警2026-08-27 发布INFO

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all...

CVE-2026-81679

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST AP

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-27 发布INFO

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint op...

CVE-2026-81101

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute i

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

安全公告2026-08-27 发布INFO

OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API

CVE-2026-81679

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST AP

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200

安全公告2026-08-27 发布INFO

Airtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint

CVE-2026-81101

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute i

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200

漏洞预警2026-08-27 发布INFO

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, all...

CVE-2026-78138

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sal

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-27 发布INFO

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthe...

CVE-2026-78125

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in a

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-27 发布INFO

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before se...

CVE-2026-77017

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine t

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-27 发布INFO

The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable...

CVE-2026-19715

The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

安全公告2026-08-26 发布INFO

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

CVE-2026-54553

## Summary Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-200 #cwe-248 #cwe-602 #cwe-639

漏洞预警2026-08-26 发布MEDIUM

The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's sto...

CVE-2026-78146

WordPress 插件 Simple Newsletter Plugin 在 4.3.3 版本之前存在一个访问控制缺陷。该插件在渲染订阅者存储的详细信息时，没有验证请求者是否就是该订阅者本人，导致未认证的远程攻击者可以构造公开请求来获取任

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-26 发布MEDIUM

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returni...

CVE-2026-77758

CVE-2026-77758 是一个影响 WordPress 插件 “Stripe Payment Forms by WP Full Pay” 的访问控制漏洞。该插件用于通过 Stripe 支付网关创建支付表单，并管理客户门户（Custom

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-26 发布MEDIUM

The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the...

CVE-2026-77754

CVE-2026-77754 影响 WordPress 的 Kirki 插件（版本低于 6.0.14）。该插件在处理某个公开 AJAX 操作的多个端点时缺少能力检查（capability check），导致未认证的远程攻击者可以利用该缺陷。

历史摘要 · 未重新核验 · NVD

#cve #cwe-200