#cwe-693

共收录 445 条相关情报。

漏洞预警2026-09-23 发布INFO

A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue affects Apache Sling Security Bundle: b...

CVE-2026-94251

A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resou

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-09-23 发布INFO

The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication wi...

CVE-2026-91796

The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows special

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-09-22 发布INFO

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMACRO, the Run a Macr...

CVE-2026-85288

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HM

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-345 #cwe-693

安全公告2026-09-22 发布INFO

Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog

CVE-2026-85288

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HM

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-345 #cwe-693 #cwe-78

漏洞预警2026-09-21 发布INFO

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LD_PRELOAD sandbox can invoke ctypes.CDLL from an impor...

CVE-2026-79919

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under th

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-09-18 发布INFO

vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejectio...

CVE-2026-93606

vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedder exposes a host API

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-09-18 发布INFO

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. ...

CVE-2026-93605

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits chi

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

安全公告2026-09-18 发布INFO

vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species

CVE-2026-93606

vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedder exposes a host API

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-693

安全公告2026-09-18 发布INFO

vm2 NodeVM before 3.12.1 Remote Code Execution via child_process

CVE-2026-93605

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits chi

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-693

漏洞预警2026-09-18 发布INFO

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping t...

CVE-2026-86800

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-09-18 发布INFO

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL...

CVE-2026-86796

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request befo

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-09-17 发布INFO

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted local_argv and local_argc values but passed the original ar...

CVE-2026-54577

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted lo

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-693

漏洞预警2026-09-17 发布INFO

vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepareStackTrace function in lib/setup-sandbox.js builds its ou...

CVE-2026-92962

vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepare

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-09-17 发布INFO

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not avail...

CVE-2026-92959

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.the

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-09-17 发布INFO

vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly....

CVE-2026-92956

vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-09-17 发布INFO

vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder explicitly allows t...

CVE-2026-92948

vm2 versions >= 3.9.6 and therefore executes arbitrary JavaScript in an unrestricted host Node process outside the Node

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-09-17 发布INFO

vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wrapper protections due to a stale Promi...

CVE-2026-92944

vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally(

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-09-17 发布INFO

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ['*']...

CVE-2026-92938

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-09-17 发布INFO

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a singl...

CVE-2026-92934

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

安全公告2026-09-16 发布INFO

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form...

CVE-2026-92778

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-693 #severity:medium