#cwe-863

共收录 2248 条相关情报。

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, the API does not properly validate that the user has an auth...

CVE-2026-44567

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-602 #cwe-863

安全公告2026-05-15 发布INFO

phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in...

CVE-2026-46362

phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermiss

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:medium

安全公告2026-05-15 发布INFO

phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId...

CVE-2026-46366

phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks pe

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:high

安全公告2026-05-15 发布INFO

phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes...

CVE-2026-45009

phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:medium

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.12, the /api/v1/utils/code/execute endpoint executes arbitrary Py...

CVE-2026-45672

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.12, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI allows admins to restrict which API endpoints an AP...

CVE-2026-45339

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the ydoc:document:update Socket.IO event handler checks whethe...

CVE-2026-44564

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the y

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the is_user_channel_member function checks whether a ChannelMe...

CVE-2026-44561

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the i

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the _validate_collection_access function uses an incomplete al...

CVE-2026-44557

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the _

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-15 发布INFO

phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to...

CVE-2026-46366

phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks pe

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-15 发布INFO

phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to terminate execution after sending a f...

CVE-2026-46362

phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermiss

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-15 发布INFO

phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated ordinary users to access administrative endpoints by onl...

CVE-2026-45009

phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-05-14 发布INFO

Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed

CVE-2026-45672

### Summary The `/api/v1/utils/code/execute` endpoint executes arbitrary Python code via Jupyter for any verified user,

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-863 #severity:high

漏洞预警2026-05-14 发布INFO

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, broken access control in the searchAsset, searchTag, searchWidget, and searchTemplate publish-mode...

CVE-2026-45148

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, broken access control in the searchAsset,

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-14 发布INFO

Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/us...

CVE-2026-44633

Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST A

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-14 发布INFO

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease ...

CVE-2026-44283

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulne

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-14 发布INFO

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a missing authorization directive on the GET /api/v1/stabl...

CVE-2026-42572

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-863

漏洞预警2026-05-14 发布INFO

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the stora...

CVE-2026-41888

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELE

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-14 发布INFO

Incorrect Authorization vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation System allows Explo...

CVE-2025-15023

Incorrect Authorization vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Indus

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-14 发布INFO

Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed d...

CVE-2026-44374

Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints

历史摘要 · 未重新核验 · NVD

#cve #cwe-863