Cyber Security Daily Radar

#cwe-639

共收录 1946 条相关情报。

← 返回所有主题
安全公告2026-06-17 发布INFO

Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

CVE-2026-55518

## Summary A critical missing authorization flaw exists in Avo's association attach workflow. The UI and `GET /resource

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#rubygems#cwe-639#cwe-862#cwe-863#severity:critical
安全公告2026-06-17 发布INFO

Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join

CVE-2026-54324

### Summary A cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-639#cwe-863#severity:medium
安全公告2026-06-17 发布INFO

Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

CVE-2026-54015

## Summary Open WebUI's prompt version-history endpoints authorize the `prompt_id` in the URL but then act on caller-su

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#pip#cwe-284#cwe-639#severity:medium
安全公告2026-06-16 发布INFO

OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers...

CVE-2026-53863

OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidate

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-639#severity:medium
安全公告2026-06-16 发布INFO

Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles

CVE-2026-54322

### Summary Daytona's organization role update and delete endpoints authorized the caller as an owner of the organizatio

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-639#cwe-862#severity:high
漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs. Attackers who can supply a group ID to the p...

CVE-2026-53863

OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidate

历史摘要 · 未重新核验 · NVD

#cve#cwe-639
漏洞预警2026-06-16 发布INFO

The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2. This is due to the static_block_content() shor...

CVE-2026-10780

The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inclu

历史摘要 · 未重新核验 · NVD

#cve#cwe-639
漏洞预警2026-06-15 发布INFO

Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smugg...

CVE-2026-48599

Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to acc

历史摘要 · 未重新核验 · NVD

#cve#cwe-639
安全公告2026-06-15 发布INFO

Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.

CVE-2026-52699

Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-639#severity:high
安全公告2026-06-15 发布INFO

Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions.

CVE-2026-48872

Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-639#severity:high
安全公告2026-06-15 发布INFO

Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.

CVE-2026-48868

Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-639#severity:high
漏洞预警2026-06-15 发布INFO

Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.

CVE-2026-52699

Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.

历史摘要 · 未重新核验 · NVD

#cve#cwe-639
漏洞预警2026-06-15 发布INFO

Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions.

CVE-2026-48872

Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions.

历史摘要 · 未重新核验 · NVD

#cve#cwe-639
漏洞预警2026-06-15 发布INFO

Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.

CVE-2026-48868

Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.

历史摘要 · 未重新核验 · NVD

#cve#cwe-639
漏洞预警2026-06-15 发布INFO

Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.

CVE-2026-40792

Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.

历史摘要 · 未重新核验 · NVD

#cve#cwe-639
漏洞预警2026-06-15 发布INFO

Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.

CVE-2026-39518

Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.

历史摘要 · 未重新核验 · NVD

#cve#cwe-639
漏洞预警2026-06-15 发布INFO

Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions.

CVE-2025-59133

Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions.

历史摘要 · 未重新核验 · NVD

#cve#cwe-639
漏洞预警2026-06-15 发布INFO

A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderClose/OrderSuccess/PayLogOrderClose/GoodsGiveIntegral of the file app/api/cont...

CVE-2026-12204

A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderClose/OrderSuccess/Pa

历史摘要 · 未重新核验 · NVD

#cve#cwe-285#cwe-639
安全公告2026-06-12 发布INFO

MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag...

CVE-2026-54361

MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegatio

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-639#severity:high
安全公告2026-06-12 发布INFO

An improper authorization vulnerability in MISP allowed an authenticated organization...

CVE-2026-54357

An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-639#severity:medium