#cwe-639

共收录 1905 条相关情报。

← 返回所有主题

漏洞预警2026-10-21 发布HIGH

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a for...

CVE-2026-114066

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openc...

CVE-2026-113727

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{r

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.p...

CVE-2026-113643

A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the fil

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-10-20 发布INFO

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (t...

CVE-2026-111767

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations direc...

CVE-2026-113665

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATC

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-10-20 发布INFO

Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Cont...

CVE-2026-112861

Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-data

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance th...

CVE-2026-92539

A service account with user-management permissions in one organization can read, modify, disable or delete users belongi

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-863 #cwe-1220

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested un...

CVE-2026-113655

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitim

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-10-20 发布INFO

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other use...

CVE-2026-113610

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing fold...

CVE-2026-113606

Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to acces

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vu...

CVE-2026-113603

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsC...

CVE-2026-113600

Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplyin...

CVE-2026-113599

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to creat

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bul...

CVE-2026-113598

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delet

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by su...

CVE-2026-113597

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authe

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByI...

CVE-2026-113596

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other us

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API e...

CVE-2026-113359

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field val

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deploym...

CVE-2026-9589

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-10-20 发布INFO

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instruc...

CVE-2026-113353

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor an

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-20 发布INFO

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other ...

CVE-2026-113349

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() t

历史摘要 · 未重新核验 · NVD

#cve #cwe-639