#cwe-749

共收录 73 条相关情报。

← 返回所有主题

漏洞预警2026-10-30 发布HIGH

Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when AL...

CVE-2026-119978

Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by

来源摘录 · NVD

#cve #cwe-749

漏洞预警2026-10-29 发布INFO

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of perm...

CVE-2026-66088

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating sy

来源摘录 · NVD

#cve #cwe-749 #cwe-78

漏洞预警2026-10-28 发布HIGH

Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code ...

CVE-2026-118606

Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability all

来源摘录 · NVD

#cve #cwe-749

漏洞预警2026-10-28 发布HIGH

Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected instal...

CVE-2026-118602

Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability. This vulnerability allows

来源摘录 · NVD

#cve #cwe-749

漏洞预警2026-10-27 发布HIGH

A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dan...

CVE-2026-113775

A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command expos

来源摘录 · NVD

#cve #cwe-749

安全公告2026-10-24 发布INFO

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to...

CVE-2026-116019

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-749 #severity:high

安全公告2026-10-21 发布INFO

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

CVE-2026-114125

**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affect

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-22 #cwe-94 #cwe-96 #cwe-346

漏洞预警2026-10-21 发布INFO

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and cal...

CVE-2026-70387

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2

来源摘录 · NVD

#cve #cwe-749 #cwe-863

安全公告2026-10-20 发布INFO

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin...

CVE-2026-77926

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating s

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-749 #severity:high

漏洞预警2026-10-20 发布INFO

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated ...

CVE-2026-77926

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating s

历史摘要 · 未重新核验 · NVD

#cve #cwe-749

漏洞预警2026-10-13 发布INFO

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

CVE-2026-109412

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitiv

历史摘要 · 未重新核验 · NVD

#cve #cwe-749

漏洞预警2026-10-13 发布INFO

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes t...

CVE-2026-102734

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-693 #cwe-749 #cwe-913

安全公告2026-10-13 发布INFO

asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

CVE-2026-102734

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-693 #cwe-749 #cwe-913

安全公告2026-10-13 发布INFO

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal...

CVE-2026-89110

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attac

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-749 #severity:critical

漏洞预警2026-10-13 发布INFO

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations ...

CVE-2026-89110

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attac

历史摘要 · 未重新核验 · NVD

#cve #cwe-749

漏洞预警2026-10-12 发布INFO

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-suppl...

CVE-2026-109556

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC hand

历史摘要 · 未重新核验 · NVD

#cve #cwe-749

漏洞预警2026-10-12 发布INFO

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.na...

CVE-2026-109422

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code executi

历史摘要 · 未重新核验 · NVD

#cve #cwe-749

漏洞预警2026-10-12 发布INFO

A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The impacted element is the function syncInvoke of the component WebVie...

CVE-2026-108897

A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The impacted e

历史摘要 · 未重新核验 · NVD

#cve #cwe-749

漏洞预警2026-10-06 发布INFO

MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through ...

CVE-2026-106513

MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the Ze

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-749

漏洞预警2026-10-06 发布INFO

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenti...

CVE-2026-105848

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.

历史摘要 · 未重新核验 · NVD

#cve #cwe-749 #cwe-862