#cwe-862

共收录 4122 条相关情报。

漏洞预警2026-09-05 发布INFO

Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instanc...

CVE-2026-86114

Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to creat

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-09-05 发布INFO

gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint

CVE-2026-86118

gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authentic

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-09-05 发布INFO

Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

CVE-2026-86116

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any a

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-09-05 发布INFO

Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints

CVE-2026-86114

Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to creat

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-09-05 发布INFO

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all...

CVE-2026-75018

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:medium

漏洞预警2026-09-05 发布INFO

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying ...

CVE-2026-75018

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-05 发布INFO

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the `tml_ms_si...

CVE-2026-83628

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-09-05 发布INFO

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing...

CVE-2026-82684

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:high

安全公告2026-09-05 发布INFO

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint,...

CVE-2026-86091

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-ad

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:high

安全公告2026-09-05 发布INFO

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and...

CVE-2026-86090

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:high

漏洞预警2026-09-05 发布CRITICAL

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POS...

CVE-2026-52766

YesWiki 是一个基于 PHP 的 wiki 系统。在版本 4.6.6 之前，{{erasespamedcomments}} wiki 动作（位于 actions/EraseSpamedCommentsAction.php）存在严重安全

历史摘要 · 未重新核验 · NVD

#cve #cwe-276 #cwe-862

漏洞预警2026-09-04 发布HIGH

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings...

CVE-2026-86091

该 CVE 描述的是 ntopng（一种网络流量监控与分析工具）在 6.7.260717 之前版本中存在的一个访问控制缺陷。具体而言，其主机池（host pools）批量删除端点未能正确校验用户权限，导致已认证但非管理员的用户也能够通过构造

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-04 发布HIGH

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requ...

CVE-2026-86090

CVE-2026-86090 影响 ntopng 6.7.260717 之前的版本。该漏洞源于 delete endpoints 和 recipients REST v2 处理程序缺少授权检查，导致已认证的非管理员用户能够发送 POST 请

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-04 发布INFO

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, co...

CVE-2026-82684

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-09-04 发布INFO

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

CVE-2026-73842

### Summary The OpenChoreo control-plane cluster-gateway exposes internal management APIs (`/api/proxy/`, `/api/exec/`,

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-269 #cwe-306 #cwe-862 #severity:critical

安全公告2026-09-04 发布INFO

A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem...

CVE-2026-78328

A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allow

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:critical

漏洞预警2026-09-04 发布INFO

Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload ...

CVE-2026-53769

Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's di

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

安全公告2026-09-04 发布INFO

SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

CVE-2026-72795

**CVE:** This vulnerability corresponds to [CVE-2026-72795](https://nvd.nist.gov/vuln/detail/CVE-2026-72795). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-862 #severity:high

安全公告2026-09-04 发布INFO

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

CVE-2026-72796

**CVE:** This vulnerability corresponds to [CVE-2026-72796](https://nvd.nist.gov/vuln/detail/CVE-2026-72796). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-862 #severity:medium

安全公告2026-09-04 发布INFO

SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers

CVE-2026-72797

**CVE:** This vulnerability corresponds to [CVE-2026-72797](https://nvd.nist.gov/vuln/detail/CVE-2026-72797). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-862 #severity:medium