#cwe-862

共收录 4228 条相关情报。

漏洞预警2026-07-20 发布INFO

Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surfac...

CVE-2026-58482

Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalI

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-862

安全公告2026-07-20 发布INFO

Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions

CVE-2026-58482

Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalI

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-352 #cwe-862

漏洞预警2026-07-20 发布INFO

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even whe...

CVE-2026-64622

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELEC...

CVE-2026-63758

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can crea...

CVE-2026-63741

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-07-20 发布INFO

Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox

CVE-2026-64622

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

漏洞预警2026-07-20 发布INFO

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher...

CVE-2026-13432

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-20 发布INFO

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated us...

CVE-2026-12973

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation i

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-20 发布INFO

The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrar...

CVE-2026-12723

The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing u

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-20 发布INFO

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users,...

CVE-2026-11868

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellatio

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-19 发布HIGH

In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_s...

CVE-2026-63914

In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns

来源摘录 · NVD

#cve #cwe-668 #cwe-862

漏洞预警2026-07-19 发布INFO

A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAuth Handler. Executing a manipulation can lead to cross-si...

CVE-2026-16216

A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAu

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-862

漏洞预警2026-07-19 发布INFO

A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the component OAuth Credential Revoke Handler. Performing a manipula...

CVE-2026-16215

A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the compone

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

安全公告2026-07-19 发布INFO

geex-arts django-jet OAuth cross-site request forgery

CVE-2026-16216

A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAu

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-352 #cwe-862

安全公告2026-07-19 发布INFO

geex-arts django-jet OAuth Credential Revoke authorization

CVE-2026-16215

A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the compone

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862 #cwe-863

漏洞预警2026-07-17 发布CRITICAL

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and...

CVE-2026-55518

Avo 是一个用于 Ruby on Rails 应用创建管理后台的框架。在版本 3.32.1 和 4.0.0.beta.51 之前，Avo 的关联附加工作流在 UI 和 GET /resources/:resource/:id/:relat

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862 #cwe-863

漏洞预警2026-07-17 发布INFO

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses inconsistent authorization between the report listing endp...

CVE-2026-45704

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses i

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-17 发布INFO

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation through /asset/webda...

CVE-2026-45260

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV ass

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-17 发布INFO

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, the WordExport export flow in bundles/WordExportBundle/src/Controller/Transla...

CVE-2026-45703

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, the WordExport expor

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-07-17 发布INFO

Pimcore: CustomReports Share Bypass

CVE-2026-45704

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses i

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862