#cwe-862

共收录 4167 条相关情报。

漏洞预警2026-08-19 发布INFO

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores ...

CVE-2026-62667

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6,

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generat...

CVE-2026-62666

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6,

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-08-19 发布INFO

Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vul...

CVE-2026-58565

Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vul...

CVE-2026-58562

Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin....

CVE-2026-45273

MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function libr...

CVE-2026-76223

ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUN

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve res...

CVE-2026-76215

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments an

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allow...

CVE-2026-76211

phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elas

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabl...

CVE-2026-76209

phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.

CVE-2026-73394

Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.

CVE-2026-73385

Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < 2.0.8 versions.

CVE-2026-73363

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < 2.0.8 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointmen...

CVE-2026-18779

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitr...

CVE-2026-18777

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-19 发布INFO

The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker cr...

CVE-2026-13173

The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before ass

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-08-19 发布INFO

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly...

CVE-2026-66589

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Sec

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:medium

漏洞预警2026-08-18 发布MEDIUM

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a throu...

CVE-2026-66589

本报告针对 CVE-2026-66589，该漏洞影响 Kings Plugins 开发的 WordPress B2BKing 插件，版本从 n/a 至 5.2.30。漏洞类型为缺失授权（Missing Authorization），意味着在

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-18 发布INFO

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any...

CVE-2026-53453

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-18 发布MEDIUM

The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscall in include/zephyr/kernel.h) through thread_obj_validate() in kernel/thread....

CVE-2026-12631

The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscall in include/zephyr/

来源摘录 · NVD

#cve #cwe-862

安全公告2026-08-18 发布INFO

Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

CVE-2026-71322

## Summary The `CertificateExport` handler in `lemur/certificates/views.py` nests its entire ownership / `CertificateP

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-862 #severity:medium