#cwe-862

共收录 4167 条相关情报。

漏洞预警2026-08-10 发布INFO

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attac...

CVE-2026-71962

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-10 发布INFO

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

CVE-2026-72900

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-10 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/r...

CVE-2026-72737

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-08-10 发布INFO

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because Discourse...

CVE-2026-72732

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_temp

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-10 发布INFO

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from ...

CVE-2026-72723

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.ano

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-10 发布INFO

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate...

CVE-2026-72722

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-10 发布INFO

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path t...

CVE-2026-47754

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-862

漏洞预警2026-08-10 发布INFO

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conver...

CVE-2026-72759

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-10 发布INFO

Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to w...

CVE-2026-71959

Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /c

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-10 发布INFO

When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desk...

CVE-2026-15060

When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running o

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-862

漏洞预警2026-08-10 发布INFO

A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and ...

CVE-2026-72692

A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote att

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-10 发布MEDIUM

A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthent...

CVE-2026-19404

A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operati

来源摘录 · NVD

#cve #cwe-862

安全公告2026-08-09 发布INFO

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the...

CVE-2026-19350

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/in

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:medium

安全公告2026-08-09 发布INFO

A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown...

CVE-2026-19345

A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/Up

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:medium

漏洞预警2026-08-09 发布INFO

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulat...

CVE-2026-19350

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/in

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

漏洞预警2026-08-09 发布INFO

A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument task...

CVE-2026-19345

A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/Up

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

漏洞预警2026-08-07 发布MEDIUM

Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at `GET /api/v1/subscription/stripe/callback?ch...

CVE-2026-47127

Ghostfolio 是一款开源财富管理软件。在 3.4.0 版本之前，其 Stripe 结账成功回调接口 `GET /api/v1/subscription/stripe/callback?checkoutSessionId=<id>`

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-07 发布MEDIUM

Kata Containers is an open source implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnerable to ...

CVE-2026-64676

Kata Containers 是一个开源实现，通过轻量级虚拟机提供容器级隔离。在 4.0.0 之前的版本中，kata-agent 组件存在机密访客内存管理中的授权绕过漏洞。在机密容器（CoCo）部署场景下，kata-agent 依赖基于

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-07 发布HIGH

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The servi...

CVE-2026-48169

PraisonAI 是一个多智能体团队系统，其 Platform API 在 0.1.4 版本之前存在两个授权缺陷，二者叠加会彻底破坏工作区隔离。第一个缺陷位于 issues 和 projects 的服务层：该层执行全局主键查询时未校验工作

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

安全公告2026-08-07 发布INFO

Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial...

CVE-2026-19017

Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read whe

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:medium