#cwe-639

共收录 1909 条相关情报。

漏洞预警2026-09-10 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the Fil...

CVE-2026-9225

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-10 发布INFO

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.php). The dialog ch...

CVE-2026-68527

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog (c

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-09-10 发布INFO

Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) in the Calendar event edit dialog

CVE-2026-68527

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog (c

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

漏洞预警2026-09-10 发布INFO

Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentica...

CVE-2026-88877

Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx pr

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-10 发布INFO

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permissi...

CVE-2026-88865

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-09-10 发布INFO

Traefik v3.7.0 Authentication Bypass via from-to-www-redirect

CVE-2026-88877

Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx pr

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

漏洞预警2026-09-10 发布INFO

Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resolution allows a tenant to reference se...

CVE-2026-80354

Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in c

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-10 发布INFO

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared f...

CVE-2026-82582

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-10 发布INFO

BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be alte...

CVE-2026-84062

BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulner

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in b...

CVE-2026-87997

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /ap

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-09-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend/open_webui/main.p...

CVE-2026-87994

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the chann

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

安全公告2026-09-09 发布INFO

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

CVE-2026-87997

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /ap

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639 #cwe-862

安全公告2026-09-09 发布INFO

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

CVE-2026-87994

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the chann

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639 #cwe-862

漏洞预警2026-09-09 发布INFO

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete an...

CVE-2026-79324

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

安全公告2026-09-09 发布INFO

Tanium addressed an improper access controls vulnerability in Comply.

CVE-2026-87033

Tanium addressed an improper access controls vulnerability in Comply.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

安全公告2026-09-09 发布INFO

Tanium addressed an improper access controls vulnerability in Comply.

CVE-2026-87047

Tanium addressed an improper access controls vulnerability in Comply.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

安全公告2026-09-09 发布INFO

Tanium addressed an improper access controls vulnerability in Comply.

CVE-2026-87025

Tanium addressed an improper access controls vulnerability in Comply.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

安全公告2026-09-09 发布INFO

Tanium addressed an improper access controls vulnerability in Comply.

CVE-2026-87019

Tanium addressed an improper access controls vulnerability in Comply.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

漏洞预警2026-09-08 发布INFO

Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

CVE-2026-69375

Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform t

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-08 发布INFO

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows aut...

CVE-2026-86725

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMedi

历史摘要 · 未重新核验 · NVD

#cve #cwe-639