#cwe-863

共收录 2104 条相关情报。

漏洞预警2026-08-31 发布INFO

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update_exchange.php loads the first Fixer/API Layer credential ...

CVE-2026-50199

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-31 发布INFO

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/pr...

CVE-2026-53552

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile,

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-863

安全公告2026-08-31 发布INFO

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

CVE-2026-53552

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile,

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639 #cwe-863

漏洞预警2026-08-31 发布INFO

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version...

CVE-2026-79746

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-08-31 发布INFO

MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching

CVE-2026-79746

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

漏洞预警2026-08-31 发布INFO

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one sha...

CVE-2026-82879

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to th

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-08-31 发布INFO

DataEase before 2.10.26 Access Control Bypass via Share Tickets

CVE-2026-82879

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to th

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

漏洞预警2026-08-31 发布INFO

ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches t...

CVE-2026-82875

ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept or

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-31 发布INFO

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data.

CVE-2026-68951

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-31 发布INFO

Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the...

CVE-2026-82724

Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-08-31 发布INFO

Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain

CVE-2026-82724

Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

漏洞预警2026-08-30 发布INFO

Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscri...

CVE-2026-81643

Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a su

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-30 发布INFO

Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions....

CVE-2026-80223

Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to rec

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-08-30 发布INFO

Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read

CVE-2026-80223

Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to rec

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-08-30 发布INFO

Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

CVE-2026-81643

Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a su

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-08-30 发布INFO

Frappe Framework development builds contain an authorization flaw in the render_jinja_template...

CVE-2026-82634

Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:high

漏洞预警2026-08-30 发布INFO

Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Jinja templates by s...

CVE-2026-82634

Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-30 发布INFO

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's...

CVE-2026-81318

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application t

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-30 发布INFO

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, dis...

CVE-2026-81316

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-30 发布INFO

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that declares ...

CVE-2026-77454

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to bypass a scoping or authorization filter

历史摘要 · 未重新核验 · NVD

#cve #cwe-863