#cwe-863

共收录 2104 条相关情报。

安全公告2026-09-23 发布INFO

Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass

CVE-2026-95842 · CVE-2026-95843 · CVE-2026-95844 · CVE-2026-95845 · CVE-2026-95846 · CVE-2026-95847 · CVE-2026-95848 · CVE-2026-85724

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, Authorizations

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-155 #cwe-863

漏洞预警2026-09-23 发布INFO

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts c...

CVE-2026-88974

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjec

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-23 发布HIGH

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time eva...

CVE-2026-96512

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps th

来源摘录 · NVD

#cve #cwe-863

安全公告2026-09-23 发布INFO

WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

CVE-2026-88974

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjec

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

漏洞预警2026-09-23 发布INFO

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds anot...

CVE-2026-90951

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment action

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-23 发布INFO

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege rol...

CVE-2026-84743

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its R

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-23 发布INFO

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users ...

CVE-2026-84742

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before crea

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-23 发布INFO

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowi...

CVE-2026-84098

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properl

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-09-22 发布INFO

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher...

CVE-2026-95814

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries,

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:high

漏洞预警2026-09-22 发布INFO

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain...

CVE-2026-95814

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries,

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-22 发布INFO

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-or...

CVE-2026-77425

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:fea

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-863

安全公告2026-09-22 发布INFO

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

CVE-2026-88978

# Cross-tenant disclosure risk on `DurableTask` bidi RPC This is a low-severity, low-risk cross-tenant data exposure vu

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-639 #cwe-863 #severity:medium

安全公告2026-09-22 发布INFO

Gardener: Authorization Bypass via Group Subject Injection

CVE-2026-79767

## Overview The `manage-members` custom verb authorization check in the Gardener API server's `customverbauthorizer` adm

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-863 #severity:medium

安全公告2026-09-22 发布INFO

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

CVE-2026-77560

# tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an aut

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-178 #cwe-636 #cwe-863 #severity:high

安全公告2026-09-22 发布INFO

OpenBao Skips Stricter Deny Policy for LIST operations

CVE-2026-63131

## Impact When a policy operator has written `capabilities = ["deny"]` on a path with a trailing wildcard but allowed a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-863 #severity:medium

漏洞预警2026-09-22 发布INFO

Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admissi...

CVE-2026-79767

Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-22 发布INFO

Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An a...

CVE-2026-75745

Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrar

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-22 发布INFO

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacke...

CVE-2026-75728

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-22 发布INFO

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacke...

CVE-2026-75723

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-22 发布INFO

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptan...

CVE-2026-95654

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization de

历史摘要 · 未重新核验 · NVD

#cve #cwe-863