#cwe-441

共收录 138 条相关情报。

漏洞预警2026-10-28 发布MEDIUM

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity J...

CVE-2026-118687

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does n

来源摘录 · NVD

#cve #cwe-441

漏洞预警2026-10-28 发布INFO

HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resou...

CVE-2026-67077

HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the ap

历史摘要 · 未重新核验 · NVD

#cve #cwe-441 #cwe-610 #cwe-918

漏洞预警2026-10-22 发布CRITICAL

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses on...

CVE-2026-114612

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3

来源摘录 · NVD

#cve #cwe-269 #cwe-345 #cwe-441

安全公告2026-10-21 发布INFO

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

CVE-2026-114125

**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affect

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-22 #cwe-94 #cwe-96 #cwe-346

漏洞预警2026-10-21 发布MEDIUM

Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail the...

CVE-2026-114478

Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6

来源摘录 · NVD

#cve #cwe-441

漏洞预警2026-10-20 发布INFO

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafka...

CVE-2026-105311

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custo

历史摘要 · 未重新核验 · NVD

#cve #cwe-441

漏洞预警2026-10-14 发布INFO

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTool...

CVE-2026-101897

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

来源摘录 · NVD

#cve #cwe-346 #cwe-441 #cwe-940

漏洞预警2026-10-13 发布MEDIUM

Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.

CVE-2026-70148

Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information local

来源摘录 · NVD

#cve #cwe-441

漏洞预警2026-10-13 发布INFO

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure ...

CVE-2026-93294

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs

历史摘要 · 未重新核验 · NVD

#cve #cwe-441 #cwe-863 #cwe-1220

漏洞预警2026-10-12 发布INFO

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by for...

CVE-2026-109373

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-441

安全公告2026-10-12 发布INFO

ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie

CVE-2026-109373

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticat

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-441

漏洞预警2026-10-09 发布INFO

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an a...

CVE-2026-108261

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview ro

历史摘要 · 未重新核验 · NVD

#cve #cwe-346 #cwe-441 #cwe-601

安全公告2026-10-09 发布INFO

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

CVE-2026-108261

### Summary The TinaCMS admin builds its preview `` from the `/~/*` hash-router splat without checking that the value s

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-346 #cwe-441 #cwe-601 #severity:critical

漏洞预警2026-10-06 发布INFO

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster auth...

CVE-2026-106487

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backen

历史摘要 · 未重新核验 · NVD

#cve #cwe-441

漏洞预警2026-10-06 发布INFO

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An...

CVE-2026-106462

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may no

历史摘要 · 未重新核验 · NVD

#cve #cwe-441 #cwe-863

漏洞预警2026-10-06 发布INFO

Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity ...

CVE-2026-94205

Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather t

历史摘要 · 未重新核验 · NVD

#cve #cwe-441 #cwe-863

漏洞预警2026-10-06 发布INFO

Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted H...

CVE-2026-106427

Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system a

历史摘要 · 未重新核验 · NVD

#cve #cwe-441

漏洞预警2026-10-06 发布INFO

Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium...

CVE-2026-106359

Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to by

历史摘要 · 未重新核验 · NVD

#cve #cwe-441

漏洞预警2026-10-06 发布INFO

Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions into a privileged page via a co-install...

CVE-2026-106326

Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system ac

历史摘要 · 未重新核验 · NVD

#cve #cwe-441

漏洞预警2026-10-06 发布INFO

Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictio...

CVE-2026-106301

Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromise

历史摘要 · 未重新核验 · NVD

#cve #cwe-441