#cwe-862

共收录 3962 条相关情报。

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify t...

CVE-2026-105696

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permiss

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly sc...

CVE-2026-105695

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session u

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the cal...

CVE-2026-105693

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in ...

CVE-2026-105680

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts an

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ...

CVE-2026-103337

Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Conf

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through...

CVE-2026-97309

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensit

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a ...

CVE-2026-97304

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Contr

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access...

CVE-2026-97303

Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additiona...

CVE-2026-45524

In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This coul

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [Al...

CVE-2026-105635

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/proje

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284 #cwe-862

漏洞预警2026-10-05 发布INFO

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a throu...

CVE-2026-103086

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control S

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a...

CVE-2026-102383

Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Co

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects.create(...) withou...

CVE-2026-104979

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-862

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-...

CVE-2026-104971

Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset witho

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

安全公告2026-10-05 发布INFO

Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

CVE-2026-105635

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/proje

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-284 #cwe-862

安全公告2026-10-05 发布INFO

Plane: Cross-tenant stored XSS in intake enables account takeover

CVE-2026-104979

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79 #cwe-862

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member display names, UUIDs,...

CVE-2026-104968

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=us

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ returns the complete project-member roster, includi...

CVE-2026-104962

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/mem

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint ...

CVE-2026-104960

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/w

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-10-05 发布INFO

Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.cust...

CVE-2026-102779

Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 -

历史摘要 · 未重新核验 · NVD

#cve #cwe-862