#cwe-346

共收录 336 条相关情报。

漏洞预警2026-09-29 发布INFO

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed ifra...

CVE-2026-102673

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4

历史摘要 · 未重新核验 · NVD

#cve #cwe-346 #cwe-693

安全公告2026-09-29 发布INFO

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

CVE-2026-102675

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-346

安全公告2026-09-29 发布INFO

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

CVE-2026-102673

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-346 #cwe-693

漏洞预警2026-09-29 发布INFO

A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_tld.c : of the com...

CVE-2026-101278

A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-346

漏洞预警2026-09-28 发布INFO

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request.

CVE-2026-18825

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verifi

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-09-26 发布INFO

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/model/session.go and...

CVE-2026-100646

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authen

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-09-26 发布INFO

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to...

CVE-2026-100642

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-scree

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

安全公告2026-09-26 发布INFO

SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header

CVE-2026-100646

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authen

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-346

安全公告2026-09-26 发布INFO

SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth

CVE-2026-100642

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-scree

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-346

安全公告2026-09-24 发布INFO

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

CVE-2026-59723

### Summary The Cline Hub dashboard server (`@cline/cline-hub`), launched via the `cline dashboard` CLI command, accept

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-346 #severity:high

安全公告2026-09-24 发布INFO

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

CVE-2026-61742

### Summary DBHub `0.21.2` exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-306 #cwe-346 #severity:critical

漏洞预警2026-09-24 发布MEDIUM

Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may...

CVE-2026-97155

Fabasoft Folio Client 是一款本地安装的组件，通过 Web Messaging 与 Fabasoft 浏览器扩展进行通信。在 2026 之前的版本中，该客户端默认不限制哪些 Web 源可以调用其功能。用于限制允许源的注册

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-09-23 发布INFO

A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security Bundle: before 1.3.2. User...

CVE-2026-94243

A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue af

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-09-22 发布INFO

Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to req...

CVE-2026-92706

Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can caus

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-346 #cwe-668

安全公告2026-09-22 发布INFO

Dark Reader: Ability to request icon-like bitmap data from certain local web servers

CVE-2026-92706

Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can caus

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-346 #cwe-668

安全公告2026-09-20 发布INFO

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local...

CVE-2026-94111

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-346 #severity:medium

漏洞预警2026-09-20 发布INFO

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with ...

CVE-2026-94111

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

安全公告2026-09-20 发布INFO

Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon

CVE-2026-94111

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-346

漏洞预警2026-09-18 发布INFO

Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested T...

CVE-2026-92702

Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-09-18 发布INFO

trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS (aTLS) Intel TDX verification path does not copy the expected current-ses...

CVE-2026-92701

trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS (aTLS) Intel TDX

历史摘要 · 未重新核验 · NVD

#cve #cwe-346 #cwe-354