#cwe-862

共收录 4122 条相关情报。

← 返回所有主题

安全公告2026-09-04 发布INFO

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

CVE-2026-72798

**CVE:** This vulnerability corresponds to [CVE-2026-72798](https://nvd.nist.gov/vuln/detail/CVE-2026-72798). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-862 #severity:high

安全公告2026-09-04 发布INFO

SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers

CVE-2026-72799

**CVE:** This vulnerability corresponds to [CVE-2026-72799](https://nvd.nist.gov/vuln/detail/CVE-2026-72799). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-862 #severity:medium

漏洞预警2026-09-04 发布INFO

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on ...

CVE-2026-63464

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-ad

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-918

漏洞预警2026-09-04 发布INFO

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a...

CVE-2026-53602

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-862

安全公告2026-09-04 发布INFO

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

CVE-2026-63735

An authenticated user scoped to one namespace/database could invoke a custom API (`DEFINE API`) belonging to a different

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #rust #cwe-639 #cwe-862 #severity:high

漏洞预警2026-09-04 发布INFO

A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to...

CVE-2026-78328

A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-09-04 发布INFO

CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

CVE-2026-75858

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #rust #npm #cwe-94 #cwe-862 #severity:high

漏洞预警2026-09-04 发布INFO

JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access mu...

CVE-2026-78970

JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An auth

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-04 发布INFO

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpoint. Authenticated attackers can write arbitrary file cha...

CVE-2026-85669

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpo

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-04 发布INFO

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary envir...

CVE-2026-85651

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authent

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-04 发布INFO

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/{imageId}/commen...

CVE-2026-85605

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-09-04 发布INFO

potpie through 2.0.0 Missing Ownership Check via code-changes sync

CVE-2026-85669

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpo

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-09-04 发布INFO

Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay

CVE-2026-85651

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authent

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-09-04 发布INFO

Slink before 1.12.3 Missing Authorization on Image Comment Endpoints

CVE-2026-85605

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

漏洞预警2026-09-04 发布INFO

Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gas...

CVE-2026-19081

Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-04 发布INFO

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication wi...

CVE-2026-85589

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints search

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-04 发布INFO

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured ...

CVE-2026-85578

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows reader

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-04 发布INFO

Missing Authorization vulnerability in Menulux Software Inc. Menulux Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Menulux Portal: ...

CVE-2026-19043

Missing Authorization vulnerability in Menulux Software Inc. Menulux Portal allows Accessing Functionality Not Properly

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-09-04 发布INFO

phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API

CVE-2026-85589

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints search

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-09-04 发布INFO

SiYuan through 3.8.1 Authorization Bypass via getFile

CVE-2026-85578

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows reader

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862