#cwe-285

共收录 631 条相关情报。

漏洞预警2026-05-18 发布INFO

A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initializati...

CVE-2026-8786

A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseFo

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-05-15 发布MEDIUM

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, an internal-only bypass_filter parameter is exposed on the /o...

CVE-2026-45365

Open WebUI 是一个自托管的离线人工智能平台。在版本 0.8.11 之前，存在一个安全漏洞：内部仅使用的 bypass_filter 参数通过 FastAPI 查询字符串绑定暴露在 /openai/chat/completions

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-05-15 发布MEDIUM

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.5.7, a user can modify another user's model even if its visibility ...

CVE-2026-45345

该漏洞存在于Open WebUI（一个自托管的人工智能平台，支持完全离线运行）中，影响版本0.5.7之前。由于权限检查缺失，低权限用户能够修改其他用户的私有模型：即使模型的可见性设置为“私有”，攻击者在编辑模型时可以通过更改访问权限来获得未

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-05-14 发布INFO

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs. POST /api/graph/getGr...

CVE-2026-45371

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan publish-mode Reader can mutate Con

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-862

漏洞预警2026-05-14 发布INFO

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, POST /api/tag/getTag is registered with model.CheckAuth only, omitting both model.CheckAdminRole a...

CVE-2026-45147

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, POST /api/tag/getTag is registered with m

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-862

漏洞预警2026-05-14 发布INFO

Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared instance are vulnerable to a cross-tenant IDOR. Any authe...

CVE-2026-44504

Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

安全公告2026-05-13 发布INFO

SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs

CVE-2026-45371

### Summary SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs `POST /api/graph/getGraph`, `P

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-285 #cwe-862 #severity:high

安全公告2026-05-13 发布INFO

SiYuan: Broken access control in `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk

CVE-2026-45147

### Summary `POST /api/tag/getTag` is registered with `model.CheckAuth` only, omitting both `model.CheckAdminRole` and

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-285 #cwe-862 #severity:medium

漏洞预警2026-05-13 发布INFO

The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the create_advertiser AJAX action in all versions up to, and inclu...

CVE-2025-9988

The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the creat

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

安全公告2026-05-12 发布INFO

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and...

CVE-2026-34656

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-285 #severity:medium

漏洞预警2026-05-12 发布INFO

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Authorization vulnerability that could result in...

CVE-2026-34656

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-05-11 发布INFO

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden does not enforce that a groups_users.users_organizations_uuid entry belongs to the sam...

CVE-2026-43912

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden does not enforce that a group

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-05-11 发布INFO

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission...

CVE-2026-42876

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernete

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-05-11 发布INFO

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resourc...

CVE-2026-42875

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernete

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-668

漏洞预警2026-05-11 发布INFO

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permission...

CVE-2026-42609

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-285 #cwe-639 #cwe-837

漏洞预警2026-05-10 发布INFO

A vulnerability has been found in Industrial Application Software IAS Canias ERP 8.03. The affected element is the function iasGetServerInfoEvent of the component RMI Interface....

CVE-2026-8241

A vulnerability has been found in Industrial Application Software IAS Canias ERP 8.03. The affected element is the funct

历史摘要 · 未重新核验 · NVD

#cve #cwe-266 #cwe-285

安全公告2026-05-09 发布INFO

A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file...

CVE-2026-8196

A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/je

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-285 #severity:low

漏洞预警2026-05-09 发布LOW

A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/con...

CVE-2026-8196

CVE-2026-8196 是影响 JeecgBoot 3.9.1 版本的一个授权绕过漏洞。该漏洞存在于 mLogin 端点的 LoginController.java 文件中，具体位于 jeecg-module-system/jeecg-

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-05-08 发布INFO

nova-toggle-5 enables fliping booleans in the index. Prior to version 1.3.0, the toggle endpoint (POST/nova-vendor/nova-toggle/toggle/{resource}/{resourceId}) was protected only...

CVE-2026-42202

nova-toggle-5 enables fliping booleans in the index. Prior to version 1.3.0, the toggle endpoint (POST/nova-vendor/nova-

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

安全公告2026-05-08 发布INFO

Improper authorization in Microsoft Teams allows an authorized attacker to disclose information...

CVE-2026-33823

Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-285 #severity:critical