#cwe-346

共收录 336 条相关情报。

← 返回所有主题
漏洞预警2026-07-07 发布INFO

Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user...

CVE-2026-58266

Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with t

历史摘要 · 未重新核验 · NVD

安全公告2026-07-07 发布INFO

Anki: User scripts in iframes have access to the internal Anki API

CVE-2026-58266

Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with t

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-07 发布INFO

Anki's local HTTP server does not sufficiently validate requests

CVE-2026-59153

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve me

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-07 发布INFO

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the TrustProxies middleware trusts all proxies ($pro...

CVE-2026-34198

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-06 发布INFO

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN c...

CVE-2026-42341

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenti

历史摘要 · 未重新核验 · NVD

安全公告2026-07-06 发布INFO

Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing

CVE-2026-55438

### Summary Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a worksp

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-06 发布INFO

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can send an HTTP request to a server running the LangSmith SDK'...

CVE-2026-59152

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can se

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-01 发布INFO

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypas...

CVE-2026-55660

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin po

历史摘要 · 未重新核验 · NVD

安全公告2026-07-01 发布INFO

Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its text-to...

CVE-2026-56277

Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its text-to-speech (TTS) generation

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-06-30 发布INFO

Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its text-to-speech (TTS) generation endpoint (packages/server/src/controllers/text-to-speech...

CVE-2026-56277

Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its text-to-speech (TTS) generation

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-30 发布INFO

Insufficient policy enforcement in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium secur...

CVE-2026-14105

Insufficient policy enforcement in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass sa

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-30 发布INFO

Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium secu...

CVE-2026-14079

Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass s

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-30 发布INFO

Inappropriate implementation in FedCM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security ...

CVE-2026-14057

Inappropriate implementation in FedCM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same o

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-30 发布INFO

Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin dat...

CVE-2026-14053

Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-30 发布INFO

Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Ch...

CVE-2026-14046

Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-30 发布INFO

Insufficient policy enforcement in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium...

CVE-2026-14039

Insufficient policy enforcement in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to byp

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-30 发布INFO

Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to le...

CVE-2026-13913

Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-30 发布INFO

Inappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin da...

CVE-2026-13887

Inappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-30 发布INFO

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium ...

CVE-2026-13881

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypa

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-30 发布INFO

Inappropriate implementation in Network in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isol...

CVE-2026-13868

Inappropriate implementation in Network in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who

历史摘要 · 未重新核验 · NVD