#cwe-807

共收录 63 条相关情报。

安全公告2026-09-28 发布INFO

agentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decision

CVE-2026-101079

A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function i

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-20 #cwe-807

漏洞预警2026-09-23 发布INFO

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holding only the read-le...

CVE-2026-84474

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host

历史摘要 · 未重新核验 · NVD

#cve #cwe-807

漏洞预警2026-09-22 发布INFO

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-su...

CVE-2026-56682

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without

历史摘要 · 未重新核验 · NVD

#cve #cwe-307 #cwe-807

漏洞预警2026-09-22 发布INFO

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-...

CVE-2026-56681

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without

历史摘要 · 未重新核验 · NVD

#cve #cwe-807

安全公告2026-09-22 发布INFO

9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

CVE-2026-56682

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-307 #cwe-807

安全公告2026-09-22 发布INFO

9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

CVE-2026-56681

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-807

漏洞预警2026-09-18 发布INFO

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard...

CVE-2026-81179

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset

历史摘要 · 未重新核验 · NVD

#cve #cwe-807

安全公告2026-09-18 发布INFO

SysReptor: Host header injection might allow account takeover

CVE-2026-81179

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-807

漏洞预警2026-09-17 发布INFO

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI env...

CVE-2026-86863

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse prox

历史摘要 · 未重新核验 · NVD

#cve #cwe-290 #cwe-807

漏洞预警2026-09-17 发布INFO

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the i...

CVE-2026-78427

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of

历史摘要 · 未重新核验 · NVD

#cve #cwe-807

漏洞预警2026-09-15 发布INFO

webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authenti...

CVE-2026-59157

webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-290 #cwe-807

安全公告2026-09-10 发布INFO

Traefik entrypoint header-name sanitization bypassed via request trailers

CVE-2026-88004

## Summary Traefik's entrypoint defenses against spoofed trusted header names — `aliasHeadersStrategy` / `underscoreHea

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-436 #cwe-807 #severity:high

漏洞预警2026-09-10 发布INFO

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forward...

CVE-2026-88004

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses ali

历史摘要 · 未重新核验 · NVD

#cve #cwe-436 #cwe-807

安全公告2026-09-10 发布INFO

Traefik entrypoint header-name sanitization bypassed via request trailers

CVE-2026-88004

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses ali

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-436 #cwe-807

漏洞预警2026-09-08 发布INFO

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability in its local HTTP control-plane API that allows attackers to gain full agent control by sup...

CVE-2026-82533

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability in its local HTTP control-plane AP

历史摘要 · 未重新核验 · NVD

#cve #cwe-807

安全公告2026-09-08 发布INFO

DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing

CVE-2026-82533

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability in its local HTTP control-plane AP

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-807

安全公告2026-09-08 发布INFO

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked...

CVE-2026-66768

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backen

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-807 #severity:critical

漏洞预警2026-09-08 发布INFO

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this we...

CVE-2026-66768

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backen

历史摘要 · 未重新核验 · NVD

#cve #cwe-807

漏洞预警2026-09-04 发布INFO

The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the...

CVE-2026-85602

The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate b

历史摘要 · 未重新核验 · NVD

#cve #cwe-807

漏洞预警2026-08-18 发布INFO

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-...

CVE-2026-54730

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-807