#cwe-639

共收录 1905 条相关情报。

漏洞预警2026-10-12 发布INFO

Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-ad...

CVE-2026-109568

Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API cont

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging un...

CVE-2026-109427

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated toke

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-10-12 发布INFO

A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the c...

CVE-2026-108924

A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery:

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-10-12 发布INFO

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to a...

CVE-2026-89140

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authent

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a pat...

CVE-2026-102663

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-639

漏洞预警2026-10-12 发布INFO

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value ...

CVE-2026-77366

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-863

安全公告2026-10-12 发布INFO

obsidian-tc tokens can access arbitrary configured vaults

CVE-2026-77366

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639 #cwe-863

漏洞预警2026-10-12 发布INFO

SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticat...

CVE-2026-109343

SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespac

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cro...

CVE-2026-109334

SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace-

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizatio...

CVE-2026-109329

Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role adm

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user groups) on count queries using the...

CVE-2026-109303

Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authentica

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backen...

CVE-2026-109296

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disable

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested kn...

CVE-2026-109287

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered cust...

CVE-2026-109394

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProd...

CVE-2026-109393

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOr

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This i...

CVE-2026-109195

A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespace

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger belongs to the specified repos...

CVE-2026-109194

A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify w

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-10-12 发布INFO

Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php

CVE-2026-109329

Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role adm

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-10-12 发布INFO

Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query

CVE-2026-109303

Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authentica

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-10-12 发布INFO

Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes

CVE-2026-109296

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disable

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639