#cwe-22

共收录 2739 条相关情报。

漏洞预警2026-07-17 发布INFO

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lower-trust callers to execute actions beyond intended author...

CVE-2026-62229

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lowe

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-17 发布INFO

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects th...

CVE-2026-39359

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-07-17 发布INFO

OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching

CVE-2026-62229

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lowe

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

安全公告2026-07-16 发布INFO

Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name

CVE-2026-39359

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

漏洞预警2026-07-16 发布INFO

Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resulting in a path tra...

CVE-2026-44177

Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correct

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-98

安全公告2026-07-16 发布INFO

Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup

CVE-2026-44177

Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correct

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-98

漏洞预警2026-07-16 发布INFO

Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling-core did not suff...

CVE-2026-44023

Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-918

漏洞预警2026-07-16 发布INFO

Directory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via the SNMP updat...

CVE-2024-32386

Directory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote at

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-07-16 发布INFO

Docling Core has unsafe remote filename resolution

CVE-2026-44023

Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-918

漏洞预警2026-07-16 发布INFO

Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by reading req.query.filename, joining it ...

CVE-2026-55629

Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cg

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-07-16 发布INFO

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

CVE-2026-54077

### Impact The SQL `IMPORT DATABASE` statement did not require administrative privileges and passed its source URL to t

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #maven #cwe-22 #cwe-776 #cwe-918 #severity:high

安全公告2026-07-16 发布INFO

Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

CVE-2026-52832

## Summary Nuclio Dashboard exposes `POST /api/functions` without authentication by default (NOP auth mode). The `spec.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-22 #severity:medium

漏洞预警2026-07-16 发布INFO

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the s...

CVE-2026-53535

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-conf

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-59

漏洞预警2026-07-16 发布INFO

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in Snippe...

CVE-2026-46338

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-07-16 发布INFO

Whistle: Path traversal

CVE-2026-55629

Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cg

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

安全公告2026-07-16 发布INFO

Activepieces: Arbitrary file write in git-sync via path traversal and symlinks

CVE-2026-53535

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-conf

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-59

安全公告2026-07-16 发布INFO

PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

CVE-2026-46338

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

漏洞预警2026-07-16 发布INFO

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated use...

CVE-2026-46336

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-07-16 发布INFO

zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such as /../...

CVE-2026-45576

zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores at

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-16 发布INFO

zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request pa...

CVE-2026-45568

zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Fl

历史摘要 · 未重新核验 · NVD

#cve #cwe-22