#cwe-287

共收录 1081 条相关情报。

← 返回所有主题

安全公告2026-07-20 发布INFO

LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection

CVE-2026-61740

## Summary When LightRAG is deployed with `LIGHTRAG_API_KEY` set but `AUTH_ACCOUNTS` unset (an officially documented "A

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-287 #cwe-798 #severity:critical

漏洞预警2026-07-20 发布INFO

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`Ope...

CVE-2026-53595

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public

历史摘要 · 未重新核验 · NVD

#cve #cwe-178 #cwe-287 #cwe-640

漏洞预警2026-07-20 发布INFO

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages into any existing su...

CVE-2026-53591

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthen

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-07-20 发布INFO

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth b...

CVE-2026-12341

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to prot

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-07-20 发布INFO

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc proc...

CVE-2026-55626

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-07-20 发布INFO

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's attachment download route skips token authentication for...

CVE-2026-48812

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-07-20 发布INFO

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an ...

CVE-2026-46715

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentica

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

安全公告2026-07-20 发布INFO

FreeScout Allows Unauthenticated Access to Legacy Attachment Files

CVE-2026-48812

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287

漏洞预警2026-07-20 发布INFO

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor (typically TOTP),...

CVE-2026-42210

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

安全公告2026-07-20 发布INFO

xrdp: No authentication required with Xvnc backend on RHEL 9

CVE-2026-55626

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287 #cwe-306

安全公告2026-07-20 发布INFO

Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

CVE-2026-46715

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentica

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287

安全公告2026-07-20 发布INFO

Webmin 2FA requirement bypass

CVE-2026-42210

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287

漏洞预警2026-07-18 发布MEDIUM

SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. ...

CVE-2024-58363

SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope use

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-07-17 发布INFO

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-f...

CVE-2026-49852

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-326 #cwe-1391

安全公告2026-07-17 发布INFO

joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

CVE-2026-49852

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1391 #cwe-287 #cwe-326

安全公告2026-07-17 发布INFO

meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

CVE-2026-54547

## X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token ### Summary `AuthInjectionMiddleware` in `meta-ads-

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-287 #severity:high

漏洞预警2026-07-17 发布INFO

A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of the file executor_manager/app/api/v1/tasks.py of the comp...

CVE-2026-16015

A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

安全公告2026-07-17 发布INFO

poco-ai poco-claw executor_manager API tasks.py create_task missing authentication

CVE-2026-16015

A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287 #cwe-306

漏洞预警2026-07-16 发布INFO

The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account, allowing...

CVE-2026-12585

The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recover

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-07-16 发布INFO

The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a su...

CVE-2026-12492

The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actu

历史摘要 · 未重新核验 · NVD

#cve #cwe-287