#cwe-639

共收录 1926 条相关情报。

← 返回所有主题
漏洞预警2026-07-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool Socket.IO events ...

CVE-2026-59216

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call de

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread parent and reply handling did not bind parent_id to the cha...

CVE-2026-59215

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread pa

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-09 发布INFO

A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest....

CVE-2026-15191

A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettl

历史摘要 · 未重新核验 · NVD

安全公告2026-07-09 发布INFO

Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

CVE-2026-59215

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread pa

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

CVE-2026-59216

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call de

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-09 发布INFO

mettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorization

CVE-2026-15191

A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettl

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-09 发布INFO

Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allows Exploitation of Trusted Identifiers. This issue affec...

CVE-2026-1989

Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allo

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-09 发布INFO

The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.2.1 via ...

CVE-2026-12433

The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Obje

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-09 发布INFO

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all ver...

CVE-2026-13450

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-09 发布INFO

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in...

CVE-2026-12418

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordP

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-09 发布INFO

The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.8. This is due to the update_user() function accepting a ...

CVE-2026-5523

The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.

历史摘要 · 未重新核验 · NVD

安全公告2026-07-08 发布INFO

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin...

CVE-2026-60104

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to t

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-08 发布INFO

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contain...

CVE-2026-54590

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on to

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-08 发布INFO

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows...

CVE-2026-35210

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0

历史摘要 · 未重新核验 · NVD

安全公告2026-07-08 发布INFO

NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak

CVE-2026-49464

## Impact In versions from 1.5.0 up to and including 3.0.0, any authenticated portal user could complete and tamper wit

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-07-08 发布INFO

OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection

CVE-2026-35210

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-08 发布INFO

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organi...

CVE-2026-60104

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to t

历史摘要 · 未重新核验 · NVD

安全公告2026-07-08 发布INFO

Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request

CVE-2026-60104

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to t

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-08 发布INFO

A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of the file app/api/controller/gitspace/list_all.go of the co...

CVE-2026-15036

A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of t

历史摘要 · 未重新核验 · NVD

安全公告2026-07-08 发布INFO

Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization

CVE-2026-15036

A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of t

历史摘要 · 未重新核验 · OSV.dev