#cwe-522

共收录 306 条相关情报。

← 返回所有主题
安全公告2026-09-17 发布INFO

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

CVE-2026-76839

## Summary `system/config/security.yaml`'s Twig sandbox policy allow-lists `offsetget` and `offsetexists` for `Grav\Com

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-17 发布INFO

Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

CVE-2026-76846

## Summary `system/config/security.yaml`'s default `twig_sandbox.config_denied_paths` list (`plugins`, `streams`, `secu

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-17 发布INFO

Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and...

CVE-2026-54618

Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authoriza

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets ...

CVE-2026-45726

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a st

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leadin...

CVE-2026-54617

GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote

历史摘要 · 未重新核验 · NVD

安全公告2026-09-17 发布INFO

GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler

CVE-2026-54617

GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-17 发布INFO

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, a reque...

CVE-2026-85720

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HT

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql. libpq expands a ...

CVE-2026-86862

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbn

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, request...

CVE-2026-85719

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HT

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0...

CVE-2026-85717

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HT

历史摘要 · 未重新核验 · NVD

安全公告2026-09-17 发布INFO

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient...

CVE-2026-89064

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versi

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-17 发布INFO

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the `Ai1w...

CVE-2026-89064

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versi

历史摘要 · 未重新核验 · NVD

安全公告2026-09-16 发布INFO

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the...

CVE-2026-92759

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-16 发布INFO

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password field from API co...

CVE-2026-92759

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that

历史摘要 · 未重新核验 · NVD

安全公告2026-09-16 发布INFO

NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in...

CVE-2026-92256

NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_s

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-16 发布INFO

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in...

CVE-2026-76871

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-16 发布INFO

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in...

CVE-2026-76859

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the user_pass_show.cgi c

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-16 发布INFO

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in...

CVE-2026-76854

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7_web_auth_user_show.cg

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-16 发布INFO

Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure...

CVE-2026-76857

Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddns_wan_li

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-15 发布INFO

NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json read handlers. At...

CVE-2026-92256

NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_s

历史摘要 · 未重新核验 · NVD