#cwe-200

共收录 1721 条相关情报。

漏洞预警2026-08-12 发布MEDIUM

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the ...

CVE-2026-65017

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an a

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-08-12 发布MEDIUM

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values n...

CVE-2026-54183

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The mas

来源摘录 · NVD

#cve #cwe-200

安全公告2026-08-12 发布INFO

Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

CVE-2026-48786

### Summary The target search endpoint (`POST /api/latest/fleet/targets`) returned team enroll secrets and full team co

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-200 #severity:medium

安全公告2026-08-12 发布INFO

phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

CVE-2026-47132

### Summary An authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logg

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-20 #cwe-89 #cwe-200 #severity:medium

漏洞预警2026-08-12 发布INFO

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()`...

CVE-2026-47234

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::se

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-532

漏洞预警2026-08-12 发布INFO

The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the re...

CVE-2026-19073

The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one o

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-12 发布INFO

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitr...

CVE-2026-18943

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-12 发布INFO

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a ...

CVE-2026-18049

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-12 发布INFO

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users,...

CVE-2026-16253

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-resto

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-12 发布INFO

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to downlo...

CVE-2026-14925

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file downlo

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-12 发布INFO

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other cu...

CVE-2026-13168

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-12 发布INFO

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, a...

CVE-2026-12976

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-a

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-11 发布INFO

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker...

CVE-2026-73246

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kest

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-306

漏洞预警2026-08-11 发布INFO

Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checks...

CVE-2026-73230

Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-11 发布INFO

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses ...

CVE-2026-73229

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-11 发布INFO

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuratio...

CVE-2026-48771

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed du

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-11 发布INFO

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspac...

CVE-2026-48767

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-11 发布INFO

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbou...

CVE-2026-73082

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mc

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-918

漏洞预警2026-08-11 发布INFO

Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.

CVE-2026-66301

Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-11 发布INFO

Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network.

CVE-2026-65769

Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to

历史摘要 · 未重新核验 · NVD

#cve #cwe-200