#cwe-306

共收录 1261 条相关情报。

← 返回所有主题

漏洞预警2026-08-10 发布INFO

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbi...

CVE-2026-72577

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-10 发布INFO

Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVE-2026-55814

Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-07 发布CRITICAL

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP A...

CVE-2026-46409

OpenYak 是一款本地优先的智能体运行时，专门用于可靠地调用工具的模型，并在此基础上提供桌面工作区。在 1.1.3 版本之前，OpenYak 的桌面后端存在一个严重安全缺陷：其 HTTP API 被绑定在 127.0.0.1 的随机端口

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-306 #cwe-346 #cwe-352 #cwe-942

安全公告2026-08-07 发布INFO

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to...

CVE-2025-71409

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-306 #severity:high

漏洞预警2026-08-07 发布INFO

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by ...

CVE-2026-61808

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds t

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-07 发布INFO

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potent...

CVE-2025-71409

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

安全公告2026-08-07 发布INFO

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an...

CVE-2026-63508

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elev

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-306 #severity:critical

安全公告2026-08-07 发布INFO

Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level...

CVE-2026-70559

Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation t

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-306 #severity:high

安全公告2026-08-07 发布INFO

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data...

CVE-2026-53984

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerabilit

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-306 #severity:high

漏洞预警2026-08-07 发布INFO

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-63508

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elev

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-06 发布INFO

Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the ...

CVE-2026-70559

Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation t

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-06 发布INFO

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's database_backup event handler...

CVE-2026-53984

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerabilit

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

安全公告2026-08-06 发布INFO

Dinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll

CVE-2026-70559

Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation t

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-306

漏洞预警2026-08-06 发布INFO

Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated...

CVE-2026-53985

Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's serv

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-06 发布INFO

OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the ...

CVE-2026-53977

OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to termi

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

安全公告2026-08-06 发布INFO

Ground Station prior to 0.6.0 Unauthenticated Database Wipe and Arbitrary Data Injection via Socket.IO database_backup full_restore Action

CVE-2026-53983 · CVE-2026-53985 · CVE-2026-53984

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerabilit

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-306

安全公告2026-08-06 发布INFO

Ground Station prior to 0.6.0 Unauthenticated DoS via service_control Socket.IO

CVE-2026-53985

Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's serv

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-306

漏洞预警2026-08-06 发布INFO

A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation result...

CVE-2026-18990

A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts o

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-08-05 发布INFO

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocke...

CVE-2026-71319

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) expos

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-306

漏洞预警2026-08-05 发布INFO

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTT...

CVE-2026-69111

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-306