#cwe-862

共收录 4283 条相关情报。

漏洞预警2026-05-11 发布INFO

In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the integrated call path ...

CVE-2026-33357

In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-11 发布INFO

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registra...

CVE-2026-42613

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attac

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-862

漏洞预警2026-05-11 发布INFO

Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. A low privileged attacker with remote access could potentially exploit this v...

CVE-2026-32658

Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. A low privileged att

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-05-10 发布INFO

WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability...

CVE-2021-47932

WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to c

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:critical

漏洞预警2026-05-10 发布INFO

WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted reques...

CVE-2021-47932

WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to c

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-09 发布INFO

A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component Dispatcher. The ma...

CVE-2026-8194

A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-862

漏洞预警2026-05-09 发布INFO

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature....

CVE-2026-42569

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS a

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-306 #cwe-862

安全公告2026-05-09 发布INFO

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without...

CVE-2025-15634

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to vie

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:medium

漏洞预警2026-05-09 发布INFO

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL acce...

CVE-2025-15634

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to vie

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-05-09 发布INFO

PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT...

CVE-2026-6667

PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:medium

漏洞预警2026-05-09 发布MEDIUM

PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console (which itself r...

CVE-2026-6667

CVE-2026-6667 是 PgBouncer（一个 PostgreSQL 连接池中间件）中存在的授权检查缺失漏洞。在 1.25.2 版本之前，PgBouncer 对 KILL_CLIENT 管理命令执行了不充分的授权校验。具体而言，任

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-05-08 发布INFO

free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers

CVE-2026-44329

### Summary free5GC's SMF mounts the `UPI` management route group without OAuth2/bearer-token authorization middleware.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-306 #cwe-862 #severity:critical

安全公告2026-05-08 发布INFO

free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating

CVE-2026-44328

### Summary free5GC's SMF mounts the `UPI` management route group without inbound OAuth2 middleware (same root cause as

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-306 #cwe-476 #cwe-862 #severity:high

安全公告2026-05-08 发布INFO

free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler

CVE-2026-44327

### Summary free5GC's NEF mounts the `nnef-oam` route group without inbound OAuth2/bearer-token authorization. A network

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-306 #cwe-862 #severity:critical

安全公告2026-05-08 发布INFO

free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions

CVE-2026-44326

### Summary free5GC's NEF mounts the `3gpp-traffic-influence` API without inbound OAuth2/bearer-token authorization. A n

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-862 #severity:critical

安全公告2026-05-08 发布INFO

free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)

CVE-2026-44321

### Summary free5GC's SMF mounts the `UPI` management route group without inbound OAuth2 middleware (same root cause as

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-306 #cwe-617 #cwe-862 #severity:high

安全公告2026-05-08 发布INFO

free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path

CVE-2026-44320

### Summary free5GC's NEF mounts the `nnef-callback` route group without inbound OAuth2/bearer-token authorization. A fo

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-306 #cwe-862 #severity:high

安全公告2026-05-08 发布INFO

free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions

CVE-2026-44315

### Summary free5GC's NEF mounts the `3gpp-pfd-management` API without inbound OAuth2/bearer-token authorization. A netw

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-862 #severity:critical

安全公告2026-05-08 发布INFO

Open WebUI has Improper Authorization Control

CVE-2026-44567

# **CONFIDENTIAL** # Vulnerability Disclosure Analysis Documentation --- ## Vulnerability Details | # | Field | Valu

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-862 #severity:high

安全公告2026-05-08 发布INFO

Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search

CVE-2026-44560

# Unauthorized File and Knowledge Base Content Access via RAG Vector Search ## Affected Component RAG source resolutio

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-862 #severity:medium