#cwe-862

共收录 4228 条相关情报。

← 返回所有主题
漏洞预警2026-07-16 发布INFO

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in ufo/server/ws/handler.py called get_o...

CVE-2026-55440

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-16 发布INFO

Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE c...

CVE-2026-54568

Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a c

历史摘要 · 未重新核验 · NVD

安全公告2026-07-16 发布INFO

Yamcs: Unauthorized user enumeration via IAM API endpoints

CVE-2026-44595

Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGrou

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-16 发布INFO

Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service

CVE-2026-55440

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-16 发布INFO

Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info

CVE-2026-54568

Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a c

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-16 发布INFO

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. Thi...

CVE-2026-15610

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorizatio

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-16 发布INFO

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that...

CVE-2026-15407

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-16 发布INFO

The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.20. This is due to the plugin not properly verifying th...

CVE-2026-15350

The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-16 发布INFO

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. Thi...

CVE-2026-15106

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorizatio

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-16 发布INFO

The RTMKit WordPress plugin before 2.0.9 does not perform a proper capability check on one of its -builder AJAX actions, allowing users with at least the Author role to create a...

CVE-2026-12907

The RTMKit WordPress plugin before 2.0.9 does not perform a proper capability check on one of its -builder AJAX actions,

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-16 发布INFO

The Catch Themes Demo Import plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.3. This is due to the catch_themes_demo_import_activ...

CVE-2026-15336

The Catch Themes Demo Import plugin for WordPress is vulnerable to Missing Authorization in versions up to, and includin

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-16 发布INFO

The List category posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.95.0 via the sanitize_status. This makes it ...

CVE-2026-12434

The List category posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-15 发布INFO

Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export t...

CVE-2026-53447

Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js use

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-15 发布INFO

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publications/boards.js copies a board by caller-supplied board ID w...

CVE-2026-53445

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publicatio

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-15 发布INFO

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/oidc_server.js, server/models/org.js, and server/models/te...

CVE-2026-53444

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/o

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-15 发布INFO

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead of writ...

CVE-2026-52892

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use r

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-15 发布INFO

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled throu...

CVE-2026-54052

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-15 发布INFO

WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation is possible through unguarded permission parameters in signUp API, which allows any use...

CVE-2026-33684

WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation is possible through unguarded

历史摘要 · 未重新核验 · NVD

安全公告2026-07-15 发布INFO

Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID

CVE-2026-53447

Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js use

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-15 发布INFO

Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin

CVE-2026-53444

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/o

历史摘要 · 未重新核验 · OSV.dev