#cwe-862

共收录 3925 条相关情报。

漏洞预警2026-10-29 发布MEDIUM

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login res...

CVE-2026-117627

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Googl

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-29 发布MEDIUM

The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenti...

CVE-2026-78395

The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when proc

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-29 发布MEDIUM

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for...

CVE-2026-19610

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-29 发布MEDIUM

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated at...

CVE-2026-115302

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes st

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-29 发布MEDIUM

The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone...

CVE-2026-110030

The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not hon

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-29 发布LOW

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated...

CVE-2026-108685

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profil

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-29 发布INFO

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.

CVE-2026-118426

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in ...

CVE-2026-75520

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the

来源摘录 · NVD

#cve #cwe-22 #cwe-862

漏洞预警2026-10-28 发布HIGH

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. `v...

CVE-2026-61571

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control

来源摘录 · NVD

#cve #cwe-306 #cwe-862

漏洞预警2026-10-28 发布HIGH

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post...

CVE-2026-118804

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthe...

CVE-2026-118757

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerab

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished dra...

CVE-2026-118754

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布INFO

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path ...

CVE-2026-116794

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 un

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

CVE-2026-105620

PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymi

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

CVE-2026-105619

PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Ano

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables. Direct access to the paritions / inheritance tables is masked but not thru ...

CVE-2026-105618

PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables. Direct access to t

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布LOW

PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is resolved in PostgreSQL Anonymizer 3.3...

CVE-2026-105612

PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked ro

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布INFO

An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read a file or an environment variable from the broker host and return i...

CVE-2026-112375

An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read a file or

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布HIGH

YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/templat...

CVE-2026-59979

YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snaps

来源摘录 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-10-28 发布HIGH

Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authoriza...

CVE-2026-56828

Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain aut

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-285 #cwe-862