#cwe-285

共收录 628 条相关情报。

← 返回所有主题
漏洞预警2026-07-09 发布INFO

A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest....

CVE-2026-15191

A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettl

历史摘要 · 未重新核验 · NVD

安全公告2026-07-09 发布INFO

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

CVE-2026-59226

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute_

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

mettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorization

CVE-2026-15191

A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettl

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-08 发布INFO

NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

CVE-2026-49463

## Impact In versions up to and including 3.0.0, two parts of the GraphQL API returned data without checking whether th

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-08 发布INFO

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user could receive messa...

CVE-2026-58252

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-08 发布INFO

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription d...

CVE-2026-58251

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.

历史摘要 · 未重新核验 · NVD

安全公告2026-07-08 发布INFO

NATS Server: Subscribe Authz Bypass via Wildcard-Overlap

CVE-2026-58252

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-08 发布INFO

NATS Server: Queue Subscribe Authz Bypass

CVE-2026-58251

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-08 发布INFO

A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of the file app/api/controller/gitspace/list_all.go of the co...

CVE-2026-15036

A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of t

历史摘要 · 未重新核验 · NVD

安全公告2026-07-08 发布INFO

Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization

CVE-2026-15036

A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of t

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-08 发布INFO

Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org when transferring applications between organizations. Attack...

CVE-2026-56293

Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org whe

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-08 发布INFO

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user's permis...

CVE-2026-56246

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped A

历史摘要 · 未重新核验 · NVD

安全公告2026-07-08 发布INFO

Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app()

CVE-2026-56293

Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org whe

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-08 发布INFO

Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege Inheritance

CVE-2026-56246

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped A

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-08 发布INFO

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates th...

CVE-2026-55428

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

历史摘要 · 未重新核验 · NVD

安全公告2026-07-07 发布INFO

Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

CVE-2026-55428

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-07 发布INFO

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `PUT /api/v2/users/{user}/passwo...

CVE-2026-55077

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

历史摘要 · 未重新核验 · NVD

安全公告2026-07-07 发布INFO

Coder: User-admin role can reset owner account password

CVE-2026-55077

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-07 发布INFO

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and doe...

CVE-2026-46700

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-serve

历史摘要 · 未重新核验 · NVD

安全公告2026-07-07 发布INFO

Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets

CVE-2026-46700

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-serve

历史摘要 · 未重新核验 · OSV.dev